Overview

overview

10

Static

static

5

JaffaCakes...10.exe

windows7-x64

10

JaffaCakes...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    70s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 07:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_0a623d1323ee9b74d08428d2c17f7910.exe

  • Size

    156KB

  • MD5

    0a623d1323ee9b74d08428d2c17f7910

  • SHA1

    0de4140a4f56455ae30175eef3e6f9af93517f82

  • SHA256

    000880adc66e24a46b36ddf040972792fcddd22b12ee8ff2540fa581635375e1

  • SHA512

    dd37cba381f3921ca9187091b9c9d1372a2c0b526391054bb1e3d89d0144673c44bec01a1eb78d89cf38e6628133968bdd7ed305751142ea92262024b053d7a6

  • SSDEEP

    3072:j0ViWhz161TE7dVeLPXPfk1HWBNnnT2VaXKKW319DsG4CcKe4f5xJmVf:QMexaMtqndGpbi89mVf

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 64 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1188
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1248
          • C:\Windows\System32\1woi1z.exe
            "C:\Windows\System32\1woi1z.exe"
            2⤵
              PID:1572
            • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a623d1323ee9b74d08428d2c17f7910.exe
              "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a623d1323ee9b74d08428d2c17f7910.exe"
              2⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Loads dropped DLL
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2092
              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                C:\Windows\system32\ydjrkrymyr\explorer.exe
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1936
                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2784
                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:788
                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1912
                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Enumerates connected drives
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2812
                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                          8⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Enumerates connected drives
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1056
                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                            9⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1944
                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                              10⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Enumerates connected drives
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2324
                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                11⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2956
                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                  12⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2852
                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                    13⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Enumerates connected drives
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2940
                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                      14⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2000
                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                        15⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:344
                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                          16⤵
                                          • Executes dropped EXE
                                          • Enumerates connected drives
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1892
                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                            17⤵
                                            • Executes dropped EXE
                                            • Enumerates connected drives
                                            PID:3532
                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                              18⤵
                                                PID:1336
                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                  19⤵
                                                    PID:4736
                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                      20⤵
                                                        PID:5656
                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                          21⤵
                                                            PID:4128
                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                              22⤵
                                                                PID:8440
                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                  23⤵
                                                                    PID:5164
                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                            19⤵
                                                              PID:10956
                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                            18⤵
                                                              PID:6488
                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                            17⤵
                                                              PID:9008
                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                            16⤵
                                                              PID:5244
                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                17⤵
                                                                  PID:8964
                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                              15⤵
                                                                PID:6112
                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                  16⤵
                                                                    PID:5320
                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                      17⤵
                                                                        PID:9040
                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                  14⤵
                                                                    PID:3592
                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                      15⤵
                                                                        PID:3192
                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                          16⤵
                                                                            PID:5388
                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                              17⤵
                                                                                PID:9076
                                                                      • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                        C:\Windows\system32\rmuueugtlu\smss.exe
                                                                        13⤵
                                                                          PID:4564
                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                            14⤵
                                                                              PID:2900
                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                15⤵
                                                                                  PID:3472
                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                    16⤵
                                                                                      PID:5544
                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                        17⤵
                                                                                          PID:6128
                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                    14⤵
                                                                                      PID:7148
                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                  12⤵
                                                                                    PID:3972
                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                      13⤵
                                                                                        PID:4596
                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                          14⤵
                                                                                            PID:696
                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                              15⤵
                                                                                                PID:3264
                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                  16⤵
                                                                                                    PID:5568
                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                      17⤵
                                                                                                        PID:5104
                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                  14⤵
                                                                                                    PID:7164
                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                  13⤵
                                                                                                    PID:10788
                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                11⤵
                                                                                                • Executes dropped EXE
                                                                                                • Enumerates connected drives
                                                                                                • Drops file in System32 directory
                                                                                                PID:3440
                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                  12⤵
                                                                                                    PID:3960
                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                      13⤵
                                                                                                        PID:4580
                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                          14⤵
                                                                                                            PID:1936
                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                              15⤵
                                                                                                                PID:3232
                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                  16⤵
                                                                                                                    PID:5468
                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                      17⤵
                                                                                                                        PID:9208
                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                  14⤵
                                                                                                                    PID:7288
                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                  13⤵
                                                                                                                    PID:10760
                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                  12⤵
                                                                                                                    PID:6268
                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                10⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2840
                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                  11⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Enumerates connected drives
                                                                                                                  PID:3492
                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                    12⤵
                                                                                                                      PID:4084
                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                        13⤵
                                                                                                                          PID:4728
                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                            14⤵
                                                                                                                              PID:5684
                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                15⤵
                                                                                                                                  PID:4152
                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                    16⤵
                                                                                                                                      PID:8488
                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                        17⤵
                                                                                                                                          PID:5892
                                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                  13⤵
                                                                                                                                    PID:10932
                                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                  12⤵
                                                                                                                                    PID:6404
                                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                  11⤵
                                                                                                                                    PID:8932
                                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                9⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1988
                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                  10⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:1884
                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                    11⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    PID:3708
                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                      12⤵
                                                                                                                                        PID:4260
                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                          13⤵
                                                                                                                                            PID:4844
                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                              14⤵
                                                                                                                                                PID:5788
                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                  15⤵
                                                                                                                                                    PID:4424
                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                      16⤵
                                                                                                                                                        PID:8572
                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                          17⤵
                                                                                                                                                            PID:5272
                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                    13⤵
                                                                                                                                                      PID:11028
                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                    12⤵
                                                                                                                                                      PID:6660
                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                    11⤵
                                                                                                                                                      PID:1212
                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                    10⤵
                                                                                                                                                      PID:5764
                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                        11⤵
                                                                                                                                                          PID:8212
                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                    8⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:864
                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                      9⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:1552
                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                        10⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        PID:3216
                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                          11⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                          PID:3752
                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                            12⤵
                                                                                                                                                              PID:4324
                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                13⤵
                                                                                                                                                                  PID:4900
                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                    14⤵
                                                                                                                                                                      PID:5848
                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                        15⤵
                                                                                                                                                                          PID:4556
                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                            16⤵
                                                                                                                                                                              PID:8620
                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                17⤵
                                                                                                                                                                                  PID:6164
                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                          13⤵
                                                                                                                                                                            PID:11080
                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                          12⤵
                                                                                                                                                                            PID:10432
                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                          11⤵
                                                                                                                                                                            PID:4068
                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                          10⤵
                                                                                                                                                                            PID:8544
                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                              11⤵
                                                                                                                                                                                PID:6348
                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:1776
                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                10⤵
                                                                                                                                                                                  PID:8536
                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                    11⤵
                                                                                                                                                                                      PID:4284
                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                              7⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:1688
                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                8⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:1764
                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                  9⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:3048
                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                    10⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    PID:3280
                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                      11⤵
                                                                                                                                                                                        PID:3800
                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                          12⤵
                                                                                                                                                                                            PID:4360
                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                              13⤵
                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                    PID:5928
                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                        PID:756
                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                            PID:8716
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                      C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                        PID:11128
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                      C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                        PID:10508
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                      C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                        PID:8176
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                      C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                        PID:8648
                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:2572
                                                                                                                                                                                                      • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                        C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:8664
                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:6176
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:8684
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:6520
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:1080
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        PID:3340
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:3852
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                            PID:3604
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                PID:8848
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                            PID:6944
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                            PID:10628
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                            PID:8756
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:4940
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                PID:8740
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                  PID:1712
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                      PID:8732
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:8764
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:2752
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:912
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:1352
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:3000
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                            PID:1472
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                              PID:2344
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                  PID:8416
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                      PID:6152
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                PID:10940
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                PID:6360
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                PID:8904
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                PID:5156
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                    PID:8920
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                      PID:5204
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                          PID:9024
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                      PID:5096
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                          PID:6096
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                  PID:9084
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                            PID:9068
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:7208
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:992
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                      PID:1368
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                        PID:1964
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            PID:676
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                              PID:3596
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                                                  PID:8448
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                PID:10992
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                PID:6536
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                PID:9128
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                    PID:9140
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                      PID:5484
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                          PID:9176
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                          PID:2416
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                              PID:5584
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:4612
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                PID:3688
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3872
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9196
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                        PID:8396
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5640
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3912
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:8476
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6516
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:10976
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                              PID:1592
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:2848
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies firewall policy service
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • Windows security bypass
                                                                                                                                                                                                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                                                                                                      • Deletes itself
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Windows security modification
                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                        PID:288
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                          PID:2660
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4872
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:8612
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6724
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:11064
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6676
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8432
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8524
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6200
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10964
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8456
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10948
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\rmuueugtlu\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6588
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:608

                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                      Replication Through Removable Media

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1091

                                                                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                      Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                      Replication Through Removable Media

                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                      T1091

                                                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                      • F:\kcdqi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                        1cd2c811e5c26718f8f462648840de5a

                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                        1e2ba5d443991b77d5f977e1fe4cf6435f8ccf7a

                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                        9130014d0eee71d8ab6e3b516c6c712674ef697255e3926e7b288e633610d434

                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                        b27b4de640a60b1668b951544b06a5e248e42e2aedcb3a7d1adeef61c6f1cd4c2f2585001dfc9780c5ec47f69e603903c8aadc546123cbfd423d719a8218626b

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                      • \Windows\SysWOW64\ydjrkrymyr\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        156KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                        0a623d1323ee9b74d08428d2c17f7910

                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                        0de4140a4f56455ae30175eef3e6f9af93517f82

                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                        000880adc66e24a46b36ddf040972792fcddd22b12ee8ff2540fa581635375e1

                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                        dd37cba381f3921ca9187091b9c9d1372a2c0b526391054bb1e3d89d0144673c44bec01a1eb78d89cf38e6628133968bdd7ed305751142ea92262024b053d7a6

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/288-627-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/344-500-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/344-491-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/788-141-0x0000000001F50000-0x0000000001FBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/788-113-0x0000000001F50000-0x0000000001FBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/788-124-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/864-487-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/912-367-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/992-351-0x0000000002300000-0x000000000236C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/992-261-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/992-329-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1052-474-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1052-377-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1056-243-0x00000000002C0000-0x000000000032C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1056-244-0x00000000002C0000-0x000000000032C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1056-235-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1056-498-0x00000000026E0000-0x000000000274C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1056-203-0x00000000002C0000-0x000000000032C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1080-497-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1112-8-0x0000000001FF0000-0x0000000001FF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1224-482-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1352-476-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1352-486-0x0000000000370000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1368-376-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1472-630-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1552-629-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1592-330-0x0000000001F70000-0x0000000001FDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1592-331-0x0000000001F70000-0x0000000001FDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1592-265-0x0000000001F70000-0x0000000001FDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1592-260-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1592-247-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1688-468-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1764-495-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1764-479-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1796-354-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1796-362-0x0000000000570000-0x00000000005DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1796-337-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1816-505-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1912-373-0x00000000026D0000-0x000000000273C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1912-177-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1912-191-0x0000000000570000-0x00000000005DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-57-0x0000000000370000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-40-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-66-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-81-0x0000000000280000-0x0000000000282000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-84-0x0000000000290000-0x0000000000291000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-112-0x0000000000280000-0x0000000000282000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-54-0x0000000000370000-0x00000000003DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1936-83-0x0000000000280000-0x0000000000282000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1944-253-0x00000000022F0000-0x000000000235C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1944-632-0x00000000026B0000-0x000000000271C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1944-631-0x00000000026B0000-0x000000000271C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1944-245-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1964-472-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1964-478-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/1988-508-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2000-469-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2000-477-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2000-490-0x0000000001FB0000-0x000000000201C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2088-341-0x0000000002330000-0x000000000239C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2088-336-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-4-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-101-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-24-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-3-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-62-0x00000000040E0000-0x000000000414C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-60-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-59-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-58-0x00000000040E0000-0x000000000414C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-20-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-100-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-55-0x0000000000290000-0x0000000000292000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-19-0x0000000000290000-0x0000000000292000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-28-0x0000000000290000-0x0000000000292000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-50-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-23-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-29-0x0000000000290000-0x0000000000292000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-7-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-64-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-47-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-46-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-6-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-27-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-45-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-5-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-26-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-44-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-91-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-25-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-34-0x00000000040E0000-0x000000000414C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-0-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-41-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2092-42-0x0000000001E40000-0x0000000002ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2280-365-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2324-255-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2752-369-0x0000000001F50000-0x0000000001FBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2752-344-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2752-355-0x0000000001F50000-0x0000000001FBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2752-366-0x0000000001F50000-0x0000000001FBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-88-0x00000000002C0000-0x00000000002C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-89-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-98-0x0000000002340000-0x00000000023AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-115-0x00000000002C0000-0x00000000002C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-99-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-123-0x0000000002340000-0x00000000023AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2784-90-0x00000000002C0000-0x00000000002C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2812-207-0x0000000002340000-0x00000000023AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2812-137-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2812-185-0x0000000002340000-0x00000000023AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2812-192-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2848-360-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2852-349-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2852-370-0x0000000000380000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2852-359-0x0000000000380000-0x00000000003EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2940-374-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2956-256-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2956-323-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2964-466-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/2964-368-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-628-0x00000000004B0000-0x000000000051C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3000-499-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3048-504-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                      • memory/3048-633-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                        Download