Overview

overview

7

Static

static

3

6304f188b2...0N.exe

windows7-x64

7

6304f188b2...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    15s
  • max time network
    79s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2024 05:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6304f188b2d5ff8788d1e0f41f1e3520N.exe

  • Size

    1.7MB

  • MD5

    6304f188b2d5ff8788d1e0f41f1e3520

  • SHA1

    ad383bac925e5ef2cf33b4af668c9ed35b6d6fb7

  • SHA256

    955b2a9e963f7afb09610cf7558d5596d12a23e8112563bf50c0324ef8fc1ad5

  • SHA512

    1c7201a42afc879b1f52a7938e056c7548181ea379042c039b994a43c83f6ca6bfc00acb4c4599efa720d946c7f1b9eb9b64fe5fbb2848b4ca73063014fcf8e1

  • SSDEEP

    49152:VIIpD141kDjl/fS2Lqbj0GbDIz3WzaKLbe:fDOuRfS2Lqf0G/IzWHbe

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5088
            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
              6⤵
                PID:4320
                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                  7⤵
                    PID:5528
                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                      8⤵
                        PID:9408
                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                          9⤵
                            PID:21612
                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                          8⤵
                            PID:2396
                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                            8⤵
                              PID:2600
                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                            7⤵
                              PID:6792
                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                8⤵
                                  PID:13640
                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                  8⤵
                                    PID:17512
                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                  7⤵
                                    PID:9676
                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                      8⤵
                                        PID:5876
                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                      7⤵
                                        PID:13372
                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                        7⤵
                                          PID:20476
                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                        6⤵
                                          PID:3192
                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                            7⤵
                                              PID:7732
                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                8⤵
                                                  PID:14092
                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                  8⤵
                                                    PID:3436
                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                  7⤵
                                                    PID:10468
                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                      8⤵
                                                        PID:22404
                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                      7⤵
                                                        PID:13476
                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                        7⤵
                                                          PID:21524
                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                        6⤵
                                                          PID:5936
                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                            7⤵
                                                              PID:10732
                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                8⤵
                                                                  PID:21604
                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                7⤵
                                                                  PID:13484
                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                  7⤵
                                                                    PID:21548
                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                  6⤵
                                                                    PID:7796
                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                      7⤵
                                                                        PID:22832
                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                      6⤵
                                                                        PID:11224
                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                        6⤵
                                                                          PID:13188
                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                          6⤵
                                                                            PID:736
                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                          5⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2040
                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                            6⤵
                                                                              PID:5664
                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                7⤵
                                                                                  PID:9268
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                    8⤵
                                                                                      PID:22396
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                    7⤵
                                                                                      PID:12988
                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                      7⤵
                                                                                        PID:1708
                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                      6⤵
                                                                                        PID:7052
                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                          7⤵
                                                                                            PID:14044
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                            7⤵
                                                                                              PID:2880
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                            6⤵
                                                                                              PID:9836
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                7⤵
                                                                                                  PID:5868
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                6⤵
                                                                                                  PID:13452
                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                  6⤵
                                                                                                    PID:21540
                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                  5⤵
                                                                                                    PID:768
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                      6⤵
                                                                                                        PID:7804
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                          7⤵
                                                                                                            PID:22460
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                          6⤵
                                                                                                            PID:11144
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                            6⤵
                                                                                                              PID:13204
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                              6⤵
                                                                                                                PID:3696
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                              5⤵
                                                                                                                PID:5972
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                  6⤵
                                                                                                                    PID:10844
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                      7⤵
                                                                                                                        PID:16324
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                      6⤵
                                                                                                                        PID:13268
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                        6⤵
                                                                                                                          PID:17504
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                        5⤵
                                                                                                                          PID:7972
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                            6⤵
                                                                                                                              PID:7132
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                            5⤵
                                                                                                                              PID:11460
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                              5⤵
                                                                                                                                PID:13140
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:17812
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                4⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:5108
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:4484
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:5672
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                          7⤵
                                                                                                                                            PID:8892
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                              8⤵
                                                                                                                                                PID:18916
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                              7⤵
                                                                                                                                                PID:4852
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:1336
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:6936
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                    7⤵
                                                                                                                                                      PID:14068
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                      7⤵
                                                                                                                                                        PID:4340
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:9852
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:17680
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:13428
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:22444
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:3908
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:8752
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:21640
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:13500
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:17972
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:5932
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:11300
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:13180
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:17496
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:7988
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:21632
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:11580
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:13092
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:4408
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:3524
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:5708
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:8908
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:21944
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:12980
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:6700
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:11000
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:17488
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:9616
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:17712
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:13316
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:3392
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:8832
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:21680
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:13508
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:20444
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5988
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:11072
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:13220
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:17696
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:7932
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:7128
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:11420
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:13124
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:17656
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:4716
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                        PID:8976
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:21928
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:544
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:18496
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:6680
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:14076
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:17212
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:9636
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:13340
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:19056
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:3216
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:8140
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                  PID:20468
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:11924
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:13068
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:11396
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:13164
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:17288
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:7780
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:21920
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:10964
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:13228
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:5552
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:9276
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:3640
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:408
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:6780
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:13404
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                        PID:22452
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:9644
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:13364
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:19428
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:8964
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:5768
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:4724
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:5980
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                          PID:10876
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:13252
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:17396
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:7924
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:21588
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:11408
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:13148
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:17280
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:832
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5520
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9400
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:21688
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:17520
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6752
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:14052
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3536
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9748
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7124
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:13420
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:17120
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4076
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:8368
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:21080
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:12048
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:13060
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6004
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:10860
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:21580
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:13260
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:17664
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7948
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7016
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:11428
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:13132
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:17256
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13380
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:21304
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6692
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13412
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:21508
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9568
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13324
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:20452
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8848
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13304
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:17052
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10772
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:21572
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13284
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:17688
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7916
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:21656
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11368
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13044
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:19048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:21532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:21564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:17388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:21624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:21596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:17672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:20196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:21696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:22412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:17648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:21952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:19040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:21704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:17232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:18528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:17720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:21516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:17380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:21556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:17240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:22468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:20460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:19436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:22428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:21672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:22476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:19032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:22484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:21648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:20188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:22344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:22436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:17224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:17704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:20436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:17528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:19016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:17248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:19024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:21664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:17264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:21936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6304f188b2d5ff8788d1e0f41f1e3520N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:17272

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gay hot (!) 40+ .mpg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    568d598676aa50ee181be181b67a794b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304d368f1bfbdbf970a332f7ae6ac17ac3429381

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6b8eb40dcc5e2cfe3ec555744385b096bf2f8a55091a19b1c7677e146604828b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ef60dad785d2854cbadfc32f86851994a4dfa6eb0bb4a8c9fead312e8495e8a41562a72c7356a74b09e0061fbcc0ef6bd9cc560cc6e9c02de68db4b6f73b956b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\debug.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    146B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    e755928aebedd4c44a9a4989599c87da

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    c8994b4c1af4131ac2f42bd1de1c87b03cf187e0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82e1fed1755117412b6cf78a79ab3894ffb5fde034dadef2adc600df7f7823af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5bec42849390cbf39b81e0c29e2491784944c3943f952ad68173c231cefacc8e5389b9290ca987aef7373f3bb21b3c5ea04cec5fbfbc6be47648cf1a881a197a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit