Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

b4bbd636c9...fN.exe

windows7-x64

10

b4bbd636c9...fN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 00:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4bbd636c976d3831a309d629337851bcc8d4675dac30c037dc3a9bd1fd8b03fN.exe

  • Size

    161KB

  • MD5

    9be69bc4d9593e93ecb4660325ea3410

  • SHA1

    ed85f4e22bca76ab33ec6fe8b62351b8f22c2913

  • SHA256

    b4bbd636c976d3831a309d629337851bcc8d4675dac30c037dc3a9bd1fd8b03f

  • SHA512

    0fe7cd8275413b278499e2ccd2abbf068a69e87679c279fab1ed01dc0da3a51dc826ce80cb0fae1d56f14c5a8b356f3a8a325aa676499e15ea5dfd990f88942e

  • SSDEEP

    3072:MQHcGUIUBz2+KWagSBUVfpHnpQuF4BOoTjcIDiFH7:7UK+niUVppQDTcXFH7

Score
10/10
floxifbackdoordiscoverytrojanupx

Malware Config

Signatures

  • Floxif family
    floxif
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 9 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4bbd636c976d3831a309d629337851bcc8d4675dac30c037dc3a9bd1fd8b03fN.exe
    "C:\Users\Admin\AppData\Local\Temp\b4bbd636c976d3831a309d629337851bcc8d4675dac30c037dc3a9bd1fd8b03fN.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Windows\SysWOW64\arp.exe
      arp -a
      2⤵
      • Network Service Discovery
      PID:2964
    • C:\Windows\SysWOW64\arp.exe
      arp -s 10.127.0.1 1f-b7-aa-07-a9-a6
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:3564
    • C:\Windows\SysWOW64\arp.exe
      arp -s 10.127.255.255 15-4b-d3-91-62-ee
      2⤵
      • Network Service Discovery
      • System Location Discovery: System Language Discovery
      PID:4596
    • C:\Windows\SysWOW64\arp.exe
      arp -s 49.12.169.208 4e-ed-25-70-32-55
      2⤵
      • Network Service Discovery
      PID:3588
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.22 b1-b0-23-9f-d6-b4
      2⤵
      • Network Service Discovery
      PID:2112
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.251 e0-71-27-ae-1e-e2
      2⤵
      • Network Service Discovery
      PID:4896
    • C:\Windows\SysWOW64\arp.exe
      arp -s 224.0.0.252 d2-cb-3f-9f-77-5e
      2⤵
      • Network Service Discovery
      PID:4964
    • C:\Windows\SysWOW64\arp.exe
      arp -s 239.255.255.250 1d-d2-bc-8e-8d-ea
      2⤵
      • Network Service Discovery
      PID:4872
    • C:\Windows\SysWOW64\arp.exe
      arp -s 255.255.255.255 19-37-04-ec-b5-41
      2⤵
      • Network Service Discovery
      PID:4424
    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
      C:\Windows\system32\hfroyyvmyb\explorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
        C:\Windows\system32\hfroyyvmyb\explorer.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
          C:\Windows\system32\hfroyyvmyb\explorer.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4168
          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
            C:\Windows\system32\hfroyyvmyb\explorer.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2436
            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
              C:\Windows\system32\hfroyyvmyb\explorer.exe
              6⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4460
              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                C:\Windows\system32\hfroyyvmyb\explorer.exe
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4448
                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3000
                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                    9⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3992
                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                      10⤵
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2456
                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                        11⤵
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:392
                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                          12⤵
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4276
                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                            13⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:760
                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4680
                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4396
                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Enumerates connected drives
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2876
                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    PID:1908
                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                      18⤵
                                        PID:4928
                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                          19⤵
                                          • Enumerates connected drives
                                          PID:2856
                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                            20⤵
                                              PID:5372
                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                21⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5448
                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                  22⤵
                                                  • Drops file in System32 directory
                                                  PID:6696
                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                    23⤵
                                                    • Enumerates connected drives
                                                    PID:7420
                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                      24⤵
                                                      • Drops file in System32 directory
                                                      PID:8300
                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                        25⤵
                                                          PID:9536
                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                            26⤵
                                                              PID:10356
                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                  20⤵
                                                    PID:11144
                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                  19⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:9448
                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                    20⤵
                                                      PID:11172
                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                  18⤵
                                                    PID:8228
                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                      19⤵
                                                        PID:9408
                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                          20⤵
                                                            PID:11180
                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                      17⤵
                                                        PID:7340
                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                          18⤵
                                                            PID:8204
                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                              19⤵
                                                                PID:9384
                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                  20⤵
                                                                    PID:11064
                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                            16⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6632
                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                              17⤵
                                                                PID:7364
                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                  18⤵
                                                                    PID:8220
                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                      19⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:9416
                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                        20⤵
                                                                          PID:11160
                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                15⤵
                                                                  PID:5172
                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                    16⤵
                                                                      PID:6608
                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                        17⤵
                                                                        • Drops file in System32 directory
                                                                        PID:7320
                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                          18⤵
                                                                            PID:4028
                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                              19⤵
                                                                                PID:9364
                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                  20⤵
                                                                                    PID:11072
                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                        14⤵
                                                                          PID:5272
                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                            15⤵
                                                                              PID:6128
                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                16⤵
                                                                                  PID:6576
                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                    17⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:7300
                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                      18⤵
                                                                                        PID:7804
                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                          19⤵
                                                                                            PID:9312
                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                              20⤵
                                                                                                PID:11024
                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                  13⤵
                                                                                    PID:2344
                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                      14⤵
                                                                                        PID:5208
                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                          15⤵
                                                                                            PID:6072
                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                              16⤵
                                                                                                PID:6496
                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                  17⤵
                                                                                                  • Enumerates connected drives
                                                                                                  PID:7192
                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                    18⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:932
                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                      19⤵
                                                                                                        PID:2100
                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                          20⤵
                                                                                                            PID:10936
                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                14⤵
                                                                                                  PID:10736
                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                              12⤵
                                                                                                PID:4684
                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                  13⤵
                                                                                                    PID:2384
                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                      14⤵
                                                                                                        PID:5236
                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                          15⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:6092
                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                            16⤵
                                                                                                              PID:6524
                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                17⤵
                                                                                                                • Enumerates connected drives
                                                                                                                PID:7240
                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                  18⤵
                                                                                                                    PID:5108
                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                      19⤵
                                                                                                                        PID:9256
                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                          20⤵
                                                                                                                            PID:10952
                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                14⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                PID:10728
                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                              13⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:5092
                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                14⤵
                                                                                                                • Enumerates connected drives
                                                                                                                PID:10784
                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                          11⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4456
                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                            12⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5056
                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                              13⤵
                                                                                                                PID:1640
                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                  14⤵
                                                                                                                    PID:5348
                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                      15⤵
                                                                                                                        PID:5380
                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                          16⤵
                                                                                                                            PID:6660
                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                              17⤵
                                                                                                                                PID:7380
                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                  18⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:8256
                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                    19⤵
                                                                                                                                      PID:9488
                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                        20⤵
                                                                                                                                          PID:11216
                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                              14⤵
                                                                                                                                PID:11108
                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                              13⤵
                                                                                                                                PID:9424
                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                  14⤵
                                                                                                                                    PID:11152
                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                12⤵
                                                                                                                                  PID:5036
                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                    13⤵
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    PID:9348
                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                      14⤵
                                                                                                                                        PID:11080
                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                10⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4668
                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                  11⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1476
                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                    12⤵
                                                                                                                                      PID:4000
                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                        13⤵
                                                                                                                                          PID:2872
                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                            14⤵
                                                                                                                                              PID:5280
                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                15⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:6120
                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                  16⤵
                                                                                                                                                    PID:6532
                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                      17⤵
                                                                                                                                                        PID:7232
                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                          18⤵
                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                          PID:3348
                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                            19⤵
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            PID:9264
                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                              20⤵
                                                                                                                                                                PID:11032
                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                    14⤵
                                                                                                                                                      PID:10808
                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                    13⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3820
                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                      14⤵
                                                                                                                                                        PID:10824
                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                    12⤵
                                                                                                                                                      PID:4016
                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                        13⤵
                                                                                                                                                          PID:4632
                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                            14⤵
                                                                                                                                                              PID:10892
                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                        11⤵
                                                                                                                                                          PID:2028
                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                            12⤵
                                                                                                                                                              PID:8040
                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                13⤵
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                PID:3036
                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                  14⤵
                                                                                                                                                                    PID:10920
                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                          9⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:5088
                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                            10⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2716
                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                              11⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:1004
                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                12⤵
                                                                                                                                                                  PID:2784
                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                    13⤵
                                                                                                                                                                      PID:2932
                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                        14⤵
                                                                                                                                                                          PID:5252
                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                            15⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:6112
                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                              16⤵
                                                                                                                                                                                PID:6540
                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                  17⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  PID:7276
                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                    18⤵
                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                    PID:2240
                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                      19⤵
                                                                                                                                                                                        PID:9304
                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                          20⤵
                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                          PID:10996
                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                              14⤵
                                                                                                                                                                                PID:10768
                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                              13⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:828
                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                14⤵
                                                                                                                                                                                  PID:10900
                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                              12⤵
                                                                                                                                                                                PID:6704
                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                  13⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  PID:9232
                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                    14⤵
                                                                                                                                                                                      PID:10960
                                                                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:2388
                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                    12⤵
                                                                                                                                                                                      PID:884
                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                        13⤵
                                                                                                                                                                                          PID:1348
                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                            14⤵
                                                                                                                                                                                              PID:10776
                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                      10⤵
                                                                                                                                                                                        PID:6416
                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                          11⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3768
                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                            12⤵
                                                                                                                                                                                              PID:8076
                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                13⤵
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:4264
                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                    PID:10856
                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                        8⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:3732
                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                          9⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:4656
                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                            10⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:2008
                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:2292
                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1432
                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:6932
                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                    PID:7708
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                        PID:8596
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                            PID:9880
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                PID:11332
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                      PID:9800
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                        PID:11296
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                      PID:8540
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                          PID:9864
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                              PID:11356
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:7680
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:8608
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:9872
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                      PID:11388
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              PID:6864
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                  PID:7612
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                      PID:8472
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                          PID:9776
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:11280
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    PID:5748
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                        PID:6896
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                            PID:7648
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                PID:8568
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:9840
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                      PID:11380
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:316
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                            PID:2156
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4476
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                      PID:8088
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:9004
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                PID:12008
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                      PID:11880
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                      PID:9652
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                          PID:11940
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                        PID:8920
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                            PID:2192
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                PID:11948
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                            PID:8024
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                              PID:8928
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                  PID:9584
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                      PID:11928
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                PID:3076
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                  PID:8012
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                      PID:8944
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                        PID:1616
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                            PID:11920
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                        PID:6168
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                            PID:8004
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:8936
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                    PID:11896
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            PID:2580
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                PID:7152
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                  PID:7964
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                      PID:8872
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                            PID:11848
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                        PID:1568
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                PID:1484
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        PID:6640
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                          PID:7184
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                            PID:9136
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                PID:10272
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                                                                    PID:12220
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                          PID:12120
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                              PID:12088
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                          PID:9056
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                              PID:2092
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                  PID:12152
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:9112
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  PID:9636
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                      PID:12184
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                PID:6456
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:8152
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                    PID:9072
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                            PID:12136
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                      PID:6516
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                          PID:8160
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                              PID:9088
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                PID:10060
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                    PID:12144
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:6440
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                    PID:8144
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                        PID:9080
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          PID:10248
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                              PID:12192
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                PID:3464
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5752
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                        PID:6400
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8120
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9040
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                  PID:10152
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:12096
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                            PID:12040
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          PID:2900
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:1508
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                              PID:3128
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:4076
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3996
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:448
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3636
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:6280
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7000
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7492
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8424
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:10492
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:10392
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:10420
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7460
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8428
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:10436
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1760
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8348
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:10444
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6256
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:8412
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                          PID:10476
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10412
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6832
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10380
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6744
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9208
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10364
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10316
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7388
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8268
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9480
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11224
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10984
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9332
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11048
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8172
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10884
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7984
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9204
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10800
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6424
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10792
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\arp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  arp -d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wamhjvwiug\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\hfroyyvmyb\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11540

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Common Files\System\symsrv.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    0609f5fe5fee88412b62aacafc43aedc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e36ebd88d34a8b9af2808eb156f108ffc30d6a26

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    b2e599e330c75124b46da9091b2546acff6dddc56d0f21d20e1af892f3ac07d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63f2ce803eed240ea27fcbef2658645a654b157dc8b2c630719bbe16de109467b28de81179cc99625c074dec4b8aa1c473798bcf48a3b394c8ea0be9edecc2d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\A1D26E2\7A028782A4.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    691bbe9926fb1e25fca69011ee582cda

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    38aa194ead7afc4fb00c878dea4ac91a2fbb53ea

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    a89de750c7600fa9ddc08bc8ae7d332bcc7a095a40ff7ee642d152432ca6a777

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6e48356a9106d02758d2ca551a6d387473f6091ff1d09a26fa70eb3667c959d4ba6e316e09aff3cf3e5708c12ccdcadf4a0aafdcfca33750f6320c8021175209

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/316-193-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/392-108-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-0-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-82-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-27-0x0000000010000000-0x0000000010032000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-33-0x0000000010000000-0x0000000010032000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-197-0x0000000010000000-0x0000000010032000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-5-0x0000000010000000-0x0000000010032000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-48-0x0000000010000000-0x0000000010032000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-196-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/676-26-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/760-149-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1004-283-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1004-265-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1068-268-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1108-184-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1108-222-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1192-111-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1440-317-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1476-266-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1476-284-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1508-211-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1568-311-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1580-297-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1592-125-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1620-152-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1908-290-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1916-227-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1952-95-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2008-263-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2136-238-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2148-267-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2156-240-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2192-130-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2192-109-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2192-156-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2200-223-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2200-248-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2208-306-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2292-299-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2436-140-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2436-53-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2456-94-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2716-224-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2716-249-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2784-302-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2836-179-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2876-261-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2900-169-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2944-97-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3000-74-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3128-245-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-136-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-161-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3384-105-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3384-254-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3384-40-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3400-147-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3484-271-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3508-102-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3568-291-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3588-300-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3676-117-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3676-141-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3680-183-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3732-186-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3748-264-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3984-114-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3992-81-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3996-312-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4000-232-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4000-31-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4000-20-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4000-90-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4000-305-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4076-277-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4112-166-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4168-120-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4168-286-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4168-45-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4276-127-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4276-146-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4276-103-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4296-301-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4296-278-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4396-225-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4448-67-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4456-280-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4460-164-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4460-59-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4464-244-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4504-162-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4604-168-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4604-142-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4608-262-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4624-316-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4624-298-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4656-230-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4668-252-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4668-228-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4680-181-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4812-138-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4812-165-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4816-158-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4896-307-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4904-279-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5016-87-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5048-191-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5088-213-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5116-205-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download