Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

c972714802...0N.exe

windows7-x64

7

c972714802...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    11s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 03:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c972714802cdfd78fe47189077a0ca70N.exe

  • Size

    1.1MB

  • MD5

    c972714802cdfd78fe47189077a0ca70

  • SHA1

    6e9d7561e8a4f16a6ab9cc296ac6c2254d31696f

  • SHA256

    5b16479a9db37b040e22d65551aa3c2d057e347c012d652460196e380483c687

  • SHA512

    02b28b69e7309e9a8980d9644c32ba4099834edc0892e655cd35beaf37eddcf84706c61448bdfe6cb438cf092f537c9a81249c6ee1047e1848560424f982b3d3

  • SSDEEP

    24576:oWIbUCI9YqzNv0PwnLRJXOKfoN6qn7jebBKGi4k7w:VI4VMP2Fg2cXCBIw

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3420
        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3184
          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:220
            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
              6⤵
                PID:3316
                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                  7⤵
                    PID:6136
                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                      8⤵
                        PID:12160
                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                        8⤵
                          PID:15860
                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                        7⤵
                          PID:7236
                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                            8⤵
                              PID:3436
                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                            7⤵
                              PID:9784
                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                8⤵
                                  PID:16452
                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                7⤵
                                  PID:12088
                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                  7⤵
                                    PID:15636
                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                  6⤵
                                    PID:5176
                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                      7⤵
                                        PID:9412
                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                          8⤵
                                            PID:17040
                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                          7⤵
                                            PID:12016
                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                            7⤵
                                              PID:15660
                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                            6⤵
                                              PID:6568
                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                7⤵
                                                  PID:12216
                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                  7⤵
                                                    PID:16172
                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                  6⤵
                                                    PID:8668
                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                      7⤵
                                                        PID:18464
                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                      6⤵
                                                        PID:12000
                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                        6⤵
                                                          PID:15548
                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                        5⤵
                                                          PID:3700
                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                            6⤵
                                                              PID:6120
                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                7⤵
                                                                  PID:11848
                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                  7⤵
                                                                    PID:14948
                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                    7⤵
                                                                      PID:14444
                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                    6⤵
                                                                      PID:7548
                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                        7⤵
                                                                          PID:18508
                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                        6⤵
                                                                          PID:10568
                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                          6⤵
                                                                            PID:11880
                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                            6⤵
                                                                              PID:16180
                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                            5⤵
                                                                              PID:5224
                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                6⤵
                                                                                  PID:8728
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                    7⤵
                                                                                      PID:18392
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                    6⤵
                                                                                      PID:12104
                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                      6⤵
                                                                                        PID:15652
                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                      5⤵
                                                                                        PID:6624
                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                          6⤵
                                                                                            PID:12704
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                            6⤵
                                                                                              PID:17032
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                            5⤵
                                                                                              PID:8488
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                6⤵
                                                                                                  PID:18384
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                5⤵
                                                                                                  PID:12280
                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                  5⤵
                                                                                                    PID:15796
                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                  4⤵
                                                                                                  • Checks computer location settings
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:3280
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                    5⤵
                                                                                                      PID:2336
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                        6⤵
                                                                                                          PID:6220
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                            7⤵
                                                                                                              PID:10600
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                              7⤵
                                                                                                                PID:11864
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                7⤵
                                                                                                                  PID:15152
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                  7⤵
                                                                                                                    PID:15964
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                  6⤵
                                                                                                                    PID:7452
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                      7⤵
                                                                                                                        PID:1720
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                      6⤵
                                                                                                                        PID:10044
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                          7⤵
                                                                                                                            PID:13836
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                            7⤵
                                                                                                                              PID:4056
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                            6⤵
                                                                                                                              PID:11928
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                              6⤵
                                                                                                                                PID:15172
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:16520
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:5208
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:9056
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:2612
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:11984
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:15540
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:6552
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:14292
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:18532
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:8660
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:7712
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:9996
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:15808
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4416
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:5480
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:10740
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:14116
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:2200
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:7260
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:19276
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:9792
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:19572
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:11936
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:15436
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:5248
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:9420
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:3668
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:12008
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:15676
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:6520
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:12744
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:2860
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:8844
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:8568
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:12048
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:16376
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                  PID:760
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:4708
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:6072
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:9880
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:20328
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:11896
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:15580
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:7556
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:18476
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:10332
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:11888
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:15556
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:9632
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:20096
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:11968
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:15588
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:6592
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:12176
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:15828
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:8420
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:7708
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:12120
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:16116
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:10944
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:14124
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:944
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:7244
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:18484
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:9624
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:6200
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:12064
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:15596
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:5280
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:9432
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:19136
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:12040
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:15612
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:6512
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:12720
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:16964
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:7616
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:18448
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:12240
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:15780
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                              PID:1164
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:1900
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:9136
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                              PID:18424
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:11808
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:15020
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:15744
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:6460
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:17516
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:9608
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:20112
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:11840
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:15012
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                              PID:16028
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:5192
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:6488
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:12232
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                        PID:15892
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:7856
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:20128
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:10632
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:12432
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:16124
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:6544
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                    PID:12728
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:17008
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:8640
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:18280
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:12272
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:16076
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6128
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:12200
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:16108
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7532
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:18524
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:10020
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:11904
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:15228
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:15184
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5272
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:9220
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:20104
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:11792
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:15144
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:16040
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6600
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:12208
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:15844
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:8444
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:17524
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:12264
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:15788
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10384
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11800
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14940
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:17704
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11824
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15188
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15912
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8820
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:18824
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11960
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15572
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6632
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12752
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:16980
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8684
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7628
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15940
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:17340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:17292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:20120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:17048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:17332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:17064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:20080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:17412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:16688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:16436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:18500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:20148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:20136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:16424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c972714802cdfd78fe47189077a0ca70N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15644

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia cum [free] hole (Karin,Jade).mpeg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226777a71d37cb2e306838a245f7dba3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a5bd4bc3579cafd15e526ac23688e4595ec198e5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  697e733f32945d3aebce4509ec910604b45eafc198daf085c7730d44f280f245

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e5ff9c0bd05d3b33d9099799a44da325d5eaa093e952cff0e13c5116b40334582966d16d55aa9cfb88ccdbe257c2cb8e8d38ea8fb83ba02e351a1cc911902d0b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-190-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/760-184-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1052-192-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1164-188-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1412-195-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1900-196-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1948-198-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2172-0-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2196-208-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2336-194-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2520-199-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3012-185-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3280-189-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3344-191-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3420-156-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3740-193-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3804-186-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4060-187-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4244-45-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4464-157-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5056-197-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5192-200-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5256-201-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5272-202-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5480-207-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6016-203-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6056-204-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6064-205-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6120-206-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6128-210-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6136-211-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6148-209-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6220-212-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6356-222-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6404-213-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6512-218-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6560-214-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6568-215-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6576-219-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6584-220-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6592-216-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6600-217-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6632-221-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6752-223-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6760-224-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6764-225-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7172-226-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7180-227-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7236-229-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7244-228-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7260-230-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7452-231-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/7616-232-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8444-233-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8584-235-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8640-236-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8648-237-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8660-238-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8676-240-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8684-241-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8692-242-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8728-239-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8820-243-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/8844-244-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9016-245-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9056-246-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9136-247-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9404-248-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9412-249-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9432-250-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9500-251-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9616-252-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9624-255-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9632-256-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9660-253-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9668-254-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9772-257-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9784-258-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9792-259-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9800-260-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/9880-264-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10020-261-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10044-262-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10132-263-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10332-265-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10384-266-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10624-267-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10632-268-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10740-269-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10920-270-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10928-271-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/10944-272-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/11816-274-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/11856-275-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/11880-276-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/11896-273-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download