de9a9d49b6e0f56317416f842a537d0cd6db308011f8af73d474251155bcfe68

Analysis

max time kernel
9s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c1f9a81a94df6800868ff5a449e8a90N.exe
Size

330KB
MD5

0c1f9a81a94df6800868ff5a449e8a90
SHA1

c29f6a539d64f7d123e5dac44b70cfa384e6fe16
SHA256

de9a9d49b6e0f56317416f842a537d0cd6db308011f8af73d474251155bcfe68
SHA512

f986254456cf318d7d2859565781d46fb2a7a70b0fb89da495bbf984c229522e9fe2f3a51c529ddd3c49fbb56fc18ca66009a0cae7f4371e86726951ba6ae5ad
SSDEEP

6144:dXC4vgmhbIxs3NBBmpgs+zbDMsiAca9nS0xe/7fbYzi7jDDiJ57/:dXCNi9BgmboXVf7gi7jiJV

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0c1f9a81a94df6800868ff5a449e8a90N.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	0c1f9a81a94df6800868ff5a449e8a90N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\Z:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\K:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\M:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\P:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\R:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\T:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\S:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\V:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\W:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\E:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\G:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\I:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\L:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\N:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\Y:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\A:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\B:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\H:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\O:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\U:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\J:	0c1f9a81a94df6800868ff5a449e8a90N.exe
File opened (read-only)	\??\Q:	0c1f9a81a94df6800868ff5a449e8a90N.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\african sperm cumshot girls ash .mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\SysWOW64\IME\SHARED\beastiality handjob several models glans shower (Britney,Sarah).rar.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\indian animal [free] nipples .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\spanish cumshot action [milf] hotel .mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american gay hot (!) nipples .mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\norwegian trambling hardcore [free] vagina gorgeoushorny .mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\System32\DriverStore\Temp\danish horse [milf] sweet (Curtney,Jenna).mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Templates\indian beast lesbian voyeur circumcision (Christine).rar.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish action xxx [milf] sweet .zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\hardcore horse hidden .mpg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\cum hardcore catfight feet (Curtney,Ashley).mpg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Google\Temp\bukkake sleeping glans (Melissa).avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\norwegian porn beast hot (!) legs balls .rar.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\cum porn [free] (Jenna,Christine).zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Common Files\microsoft shared\french gay voyeur .mpg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\dotnet\shared\fucking voyeur .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\cum full movie hole (Melissa).zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\italian horse [bangbus] hairy .rar.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\japanese gang bang [bangbus] vagina (Britney).mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish cum voyeur girly .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african xxx [bangbus] castration .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Google\Update\Download\asian beastiality [milf] titts gorgeoushorny .zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gay handjob hot (!) (Jenna).zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\handjob fucking big traffic (Sonja).mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\assembly\tmp\beastiality lingerie [free] glans .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\CbsTemp\canadian sperm cumshot voyeur legs (Gina).avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\Downloaded Program Files\horse gay sleeping wifey .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\InputMethod\SHARED\trambling blowjob licking mistress .zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\indian animal sleeping (Sonja,Sylvia).zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\black kicking [bangbus] .mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\tyrkish cum [free] sweet .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\assembly\temp\black blowjob fucking full movie (Curtney).zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\animal public circumcision .mpg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\security\templates\french porn bukkake [free] (Karin,Curtney).avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\indian fucking sleeping black hairunshaved (Sonja,Sandy).zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\fucking masturbation bedroom (Sarah,Karin).mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\german kicking hot (!) .mpg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\cum uncut .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\PLA\Templates\american gang bang girls .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\french blowjob horse girls penetration (Sandy).avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\lingerie beastiality hot (!) mature (Sonja,Sandy).mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\cum hot (!) .avi.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\mssrv.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\cumshot cumshot public vagina .zip.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\gang bang gay hot (!) ejaculation .rar.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lingerie full movie (Jenna,Liz).mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\SoftwareDistribution\Download\norwegian horse nude girls cock beautyfull .mpeg.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe
File created	C:\Windows\SoftwareDistribution\Download\SharedFileCache\british lesbian [free] wifey .rar.exe	0c1f9a81a94df6800868ff5a449e8a90N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
3972	0c1f9a81a94df6800868ff5a449e8a90N.exe
3972	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
1432	0c1f9a81a94df6800868ff5a449e8a90N.exe
1432	0c1f9a81a94df6800868ff5a449e8a90N.exe
4476	0c1f9a81a94df6800868ff5a449e8a90N.exe
4476	0c1f9a81a94df6800868ff5a449e8a90N.exe
3972	0c1f9a81a94df6800868ff5a449e8a90N.exe
3972	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
1828	0c1f9a81a94df6800868ff5a449e8a90N.exe
1828	0c1f9a81a94df6800868ff5a449e8a90N.exe
2516	0c1f9a81a94df6800868ff5a449e8a90N.exe
2516	0c1f9a81a94df6800868ff5a449e8a90N.exe
4288	0c1f9a81a94df6800868ff5a449e8a90N.exe
4288	0c1f9a81a94df6800868ff5a449e8a90N.exe
1432	0c1f9a81a94df6800868ff5a449e8a90N.exe
1432	0c1f9a81a94df6800868ff5a449e8a90N.exe
3972	0c1f9a81a94df6800868ff5a449e8a90N.exe
3972	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
536	0c1f9a81a94df6800868ff5a449e8a90N.exe
3508	0c1f9a81a94df6800868ff5a449e8a90N.exe
3508	0c1f9a81a94df6800868ff5a449e8a90N.exe
4476	0c1f9a81a94df6800868ff5a449e8a90N.exe
4476	0c1f9a81a94df6800868ff5a449e8a90N.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3972	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	89
PID 536 wrote to memory of 3972	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	89
PID 536 wrote to memory of 3972	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	89
PID 536 wrote to memory of 1432	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	92
PID 536 wrote to memory of 1432	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	92
PID 536 wrote to memory of 1432	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	92
PID 3972 wrote to memory of 4476	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	93
PID 3972 wrote to memory of 4476	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	93
PID 3972 wrote to memory of 4476	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	93
PID 1432 wrote to memory of 1828	1432	0c1f9a81a94df6800868ff5a449e8a90N.exe	95
PID 1432 wrote to memory of 1828	1432	0c1f9a81a94df6800868ff5a449e8a90N.exe	95
PID 1432 wrote to memory of 1828	1432	0c1f9a81a94df6800868ff5a449e8a90N.exe	95
PID 3972 wrote to memory of 2516	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	96
PID 3972 wrote to memory of 2516	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	96
PID 3972 wrote to memory of 2516	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	96
PID 536 wrote to memory of 4288	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	97
PID 536 wrote to memory of 4288	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	97
PID 536 wrote to memory of 4288	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	97
PID 4476 wrote to memory of 3508	4476	0c1f9a81a94df6800868ff5a449e8a90N.exe	98
PID 4476 wrote to memory of 3508	4476	0c1f9a81a94df6800868ff5a449e8a90N.exe	98
PID 4476 wrote to memory of 3508	4476	0c1f9a81a94df6800868ff5a449e8a90N.exe	98
PID 1432 wrote to memory of 3120	1432	0c1f9a81a94df6800868ff5a449e8a90N.exe	99
PID 1432 wrote to memory of 3120	1432	0c1f9a81a94df6800868ff5a449e8a90N.exe	99
PID 1432 wrote to memory of 3120	1432	0c1f9a81a94df6800868ff5a449e8a90N.exe	99
PID 3972 wrote to memory of 2808	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	100
PID 3972 wrote to memory of 2808	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	100
PID 3972 wrote to memory of 2808	3972	0c1f9a81a94df6800868ff5a449e8a90N.exe	100
PID 1828 wrote to memory of 2112	1828	0c1f9a81a94df6800868ff5a449e8a90N.exe	101
PID 1828 wrote to memory of 2112	1828	0c1f9a81a94df6800868ff5a449e8a90N.exe	101
PID 1828 wrote to memory of 2112	1828	0c1f9a81a94df6800868ff5a449e8a90N.exe	101
PID 536 wrote to memory of 4216	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	103
PID 536 wrote to memory of 4216	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	103
PID 536 wrote to memory of 4216	536	0c1f9a81a94df6800868ff5a449e8a90N.exe	103
PID 2516 wrote to memory of 980	2516	0c1f9a81a94df6800868ff5a449e8a90N.exe	104
PID 2516 wrote to memory of 980	2516	0c1f9a81a94df6800868ff5a449e8a90N.exe	104
PID 2516 wrote to memory of 980	2516	0c1f9a81a94df6800868ff5a449e8a90N.exe	104
PID 4476 wrote to memory of 1728	4476	0c1f9a81a94df6800868ff5a449e8a90N.exe	105
PID 4476 wrote to memory of 1728	4476	0c1f9a81a94df6800868ff5a449e8a90N.exe	105
PID 4476 wrote to memory of 1728	4476	0c1f9a81a94df6800868ff5a449e8a90N.exe	105
PID 4288 wrote to memory of 3876	4288	0c1f9a81a94df6800868ff5a449e8a90N.exe	106
PID 4288 wrote to memory of 3876	4288	0c1f9a81a94df6800868ff5a449e8a90N.exe	106
PID 4288 wrote to memory of 3876	4288	0c1f9a81a94df6800868ff5a449e8a90N.exe	106
PID 3508 wrote to memory of 2536	3508	0c1f9a81a94df6800868ff5a449e8a90N.exe	107
PID 3508 wrote to memory of 2536	3508	0c1f9a81a94df6800868ff5a449e8a90N.exe	107
PID 3508 wrote to memory of 2536	3508	0c1f9a81a94df6800868ff5a449e8a90N.exe	107

C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
"C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        8⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        8⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        8⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17708
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:2580
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:16824
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:13044
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:17500
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:13168
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:1572
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:13884
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:16964
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:4972
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:10904
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:14508
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:16832
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:13224
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        7⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:16532
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:12940
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:684
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:14844
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:15564
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:14016
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:9836
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:13088
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:13072
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:13440
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:15076
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:9328
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:12380
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:17524
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
        5⤵
        
        PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:13052
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:13712
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:15596
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:9344
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:12416
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:17508
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:392
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:14804
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:15532
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:9132
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:12020
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:17116
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:5460
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
      "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
      4⤵
      PID:15872
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:11676
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:16152
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:6872
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:12120
- - C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
    3⤵
    PID:17184
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:8920
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:12140
- C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe
  "C:\Users\Admin\AppData\Local\Temp\0c1f9a81a94df6800868ff5a449e8a90N.exe"
  2⤵
  PID:17212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish action xxx [milf] sweet .zip.exe

Filesize
1.3MB

MD5
d16e8b9f1bd307a04c313058a37af21b

SHA1
37297faef27fe509e27084c38ad4ad442bf62c0c

SHA256
555881561722297b5b47ff9f75aea22e22d0e8dd7a61377f21da3714e7b422c8

SHA512
b2329591e1304ee4ceb76ac011583276aecf2a6724d3d0a6f32a54ead69c553fd8f2b4fc3375812989162322f1cc19cc0d490f8d7f7d7028131051234f8d313a

Download Submit
memory/392-251-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/432-257-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/536-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/980-234-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1116-249-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1384-255-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1432-191-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1612-252-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1728-235-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1828-219-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2112-232-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2124-253-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2516-220-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2536-237-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2684-304-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2808-231-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-256-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3120-230-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3564-248-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3876-236-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4216-233-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4284-294-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4288-221-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4532-250-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4544-254-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5248-258-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5316-259-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5328-260-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5624-261-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5644-262-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5772-263-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5780-264-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5808-265-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5904-266-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6076-267-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6180-285-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6188-268-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6256-269-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6264-270-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6272-271-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6280-272-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6288-273-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6300-274-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6308-275-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6464-286-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6500-276-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6508-277-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6580-287-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6600-278-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6644-279-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6692-280-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6864-281-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6872-282-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6952-283-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7072-284-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7772-288-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7812-289-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7820-292-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7888-290-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7896-293-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7904-291-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8160-295-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8168-297-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8184-296-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8256-298-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8596-299-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8776-300-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8920-301-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9132-302-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9160-303-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9272-305-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9284-306-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9308-307-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9320-311-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9328-308-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9336-310-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9344-312-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9352-309-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9360-313-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9368-314-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9444-315-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9508-316-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9612-317-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9700-318-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9708-319-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9716-320-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9744-321-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9752-322-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9836-323-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10020-324-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10052-325-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10060-329-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10068-330-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10076-326-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10092-327-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10108-328-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download