52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/08/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
354b34a3694e2b4d54ba3bca624aa3c3.exe
Size 1.2MB
Sample240830-js9brstcqd
SHA256 52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384
MD5 354b34a3694e2b4d54ba3bca624aa3c3
SHA1 660ee183f7f7a17eace0556c8883a2c361424cb0
SHA512 f78bbbd45ee9dc147394f79c0aed2c8104c42116b72c653586ac0855d0c075e3b17571bc62e33ba055bcc91197f6e2a491e97ad35eab8f425bbf713a5e0b5870
SSDEEP 24576:+tb20pkaCqT5TBWgNQ7aLHWD2rmiOWlcIqDBZLAkxy06A:rVg5tQ7aLHWDd/B9A65
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dddddd.vbs	dddddd.exe

Executes dropped EXE 64 IoCs

pid	Process
1436	dddddd.exe
2820	dddddd.exe
2272	dddddd.exe
2872	dddddd.exe
2672	dddddd.exe
2552	dddddd.exe
1672	dddddd.exe
2408	dddddd.exe
2464	dddddd.exe
1872	dddddd.exe
2576	dddddd.exe
1916	dddddd.exe
2024	dddddd.exe
2208	dddddd.exe
2164	dddddd.exe
564	dddddd.exe
2000	dddddd.exe
1748	dddddd.exe
1080	dddddd.exe
1576	dddddd.exe
2476	dddddd.exe
344	dddddd.exe
2952	dddddd.exe
2776	dddddd.exe
2804	dddddd.exe
2840	dddddd.exe
2684	dddddd.exe
2592	dddddd.exe
2096	dddddd.exe
404	dddddd.exe
1364	dddddd.exe
2160	dddddd.exe
1148	dddddd.exe
1380	dddddd.exe
2492	dddddd.exe
684	dddddd.exe
1104	dddddd.exe
2156	dddddd.exe
1612	dddddd.exe
840	dddddd.exe
2812	dddddd.exe
1204	dddddd.exe
1532	dddddd.exe
1712	dddddd.exe
2508	dddddd.exe
1996	dddddd.exe
464	dddddd.exe
2304	dddddd.exe
2172	dddddd.exe
2728	dddddd.exe
2996	dddddd.exe
2908	dddddd.exe
2108	dddddd.exe
2092	dddddd.exe
2900	dddddd.exe
1704	dddddd.exe
1224	dddddd.exe
2424	dddddd.exe
3028	dddddd.exe
2496	dddddd.exe
2016	dddddd.exe
2448	dddddd.exe
756	dddddd.exe
2152	dddddd.exe

Loads dropped DLL 2 IoCs

pid	Process
376	354b34a3694e2b4d54ba3bca624aa3c3.exe
1436	dddddd.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00080000000186ca-13.dat	autoit_exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
376	354b34a3694e2b4d54ba3bca624aa3c3.exe
376	354b34a3694e2b4d54ba3bca624aa3c3.exe
1436	dddddd.exe
1436	dddddd.exe
2820	dddddd.exe
2820	dddddd.exe
2272	dddddd.exe
2272	dddddd.exe
2872	dddddd.exe
2872	dddddd.exe
2672	dddddd.exe
2672	dddddd.exe
2552	dddddd.exe
2552	dddddd.exe
1672	dddddd.exe
1672	dddddd.exe
2408	dddddd.exe
2408	dddddd.exe
2464	dddddd.exe
2464	dddddd.exe
1872	dddddd.exe
1872	dddddd.exe
2576	dddddd.exe
2576	dddddd.exe
1916	dddddd.exe
1916	dddddd.exe
2024	dddddd.exe
2024	dddddd.exe
2208	dddddd.exe
2208	dddddd.exe
2164	dddddd.exe
2164	dddddd.exe
564	dddddd.exe
564	dddddd.exe
2000	dddddd.exe
2000	dddddd.exe
1748	dddddd.exe
1748	dddddd.exe
1080	dddddd.exe
1080	dddddd.exe
1576	dddddd.exe
1576	dddddd.exe
2476	dddddd.exe
2476	dddddd.exe
344	dddddd.exe
344	dddddd.exe
2952	dddddd.exe
2952	dddddd.exe
2776	dddddd.exe
2776	dddddd.exe
2804	dddddd.exe
2804	dddddd.exe
2840	dddddd.exe
2840	dddddd.exe
2684	dddddd.exe
2684	dddddd.exe
2592	dddddd.exe
2592	dddddd.exe
2096	dddddd.exe
2096	dddddd.exe
404	dddddd.exe
404	dddddd.exe
1364	dddddd.exe
1364	dddddd.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
376	354b34a3694e2b4d54ba3bca624aa3c3.exe
376	354b34a3694e2b4d54ba3bca624aa3c3.exe
1436	dddddd.exe
1436	dddddd.exe
2820	dddddd.exe
2820	dddddd.exe
2272	dddddd.exe
2272	dddddd.exe
2872	dddddd.exe
2872	dddddd.exe
2672	dddddd.exe
2672	dddddd.exe
2552	dddddd.exe
2552	dddddd.exe
1672	dddddd.exe
1672	dddddd.exe
2408	dddddd.exe
2408	dddddd.exe
2464	dddddd.exe
2464	dddddd.exe
1872	dddddd.exe
1872	dddddd.exe
2576	dddddd.exe
2576	dddddd.exe
1916	dddddd.exe
1916	dddddd.exe
2024	dddddd.exe
2024	dddddd.exe
2208	dddddd.exe
2208	dddddd.exe
2164	dddddd.exe
2164	dddddd.exe
564	dddddd.exe
564	dddddd.exe
2000	dddddd.exe
2000	dddddd.exe
1748	dddddd.exe
1748	dddddd.exe
1080	dddddd.exe
1080	dddddd.exe
1576	dddddd.exe
1576	dddddd.exe
2476	dddddd.exe
2476	dddddd.exe
344	dddddd.exe
344	dddddd.exe
2952	dddddd.exe
2952	dddddd.exe
2776	dddddd.exe
2776	dddddd.exe
2804	dddddd.exe
2804	dddddd.exe
2840	dddddd.exe
2840	dddddd.exe
2684	dddddd.exe
2684	dddddd.exe
2592	dddddd.exe
2592	dddddd.exe
2096	dddddd.exe
2096	dddddd.exe
404	dddddd.exe
404	dddddd.exe
1364	dddddd.exe
1364	dddddd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1436	376	354b34a3694e2b4d54ba3bca624aa3c3.exe	30
PID 376 wrote to memory of 1436	376	354b34a3694e2b4d54ba3bca624aa3c3.exe	30
PID 376 wrote to memory of 1436	376	354b34a3694e2b4d54ba3bca624aa3c3.exe	30
PID 376 wrote to memory of 1436	376	354b34a3694e2b4d54ba3bca624aa3c3.exe	30
PID 1436 wrote to memory of 2820	1436	dddddd.exe	31
PID 1436 wrote to memory of 2820	1436	dddddd.exe	31
PID 1436 wrote to memory of 2820	1436	dddddd.exe	31
PID 1436 wrote to memory of 2820	1436	dddddd.exe	31
PID 2820 wrote to memory of 2272	2820	dddddd.exe	32
PID 2820 wrote to memory of 2272	2820	dddddd.exe	32
PID 2820 wrote to memory of 2272	2820	dddddd.exe	32
PID 2820 wrote to memory of 2272	2820	dddddd.exe	32
PID 2272 wrote to memory of 2872	2272	dddddd.exe	33
PID 2272 wrote to memory of 2872	2272	dddddd.exe	33
PID 2272 wrote to memory of 2872	2272	dddddd.exe	33
PID 2272 wrote to memory of 2872	2272	dddddd.exe	33
PID 2872 wrote to memory of 2672	2872	dddddd.exe	34
PID 2872 wrote to memory of 2672	2872	dddddd.exe	34
PID 2872 wrote to memory of 2672	2872	dddddd.exe	34
PID 2872 wrote to memory of 2672	2872	dddddd.exe	34
PID 2672 wrote to memory of 2552	2672	dddddd.exe	35
PID 2672 wrote to memory of 2552	2672	dddddd.exe	35
PID 2672 wrote to memory of 2552	2672	dddddd.exe	35
PID 2672 wrote to memory of 2552	2672	dddddd.exe	35
PID 2552 wrote to memory of 1672	2552	dddddd.exe	36
PID 2552 wrote to memory of 1672	2552	dddddd.exe	36
PID 2552 wrote to memory of 1672	2552	dddddd.exe	36
PID 2552 wrote to memory of 1672	2552	dddddd.exe	36
PID 1672 wrote to memory of 2408	1672	dddddd.exe	37
PID 1672 wrote to memory of 2408	1672	dddddd.exe	37
PID 1672 wrote to memory of 2408	1672	dddddd.exe	37
PID 1672 wrote to memory of 2408	1672	dddddd.exe	37
PID 2408 wrote to memory of 2464	2408	dddddd.exe	38
PID 2408 wrote to memory of 2464	2408	dddddd.exe	38
PID 2408 wrote to memory of 2464	2408	dddddd.exe	38
PID 2408 wrote to memory of 2464	2408	dddddd.exe	38
PID 2464 wrote to memory of 1872	2464	dddddd.exe	39
PID 2464 wrote to memory of 1872	2464	dddddd.exe	39
PID 2464 wrote to memory of 1872	2464	dddddd.exe	39
PID 2464 wrote to memory of 1872	2464	dddddd.exe	39
PID 1872 wrote to memory of 2576	1872	dddddd.exe	40
PID 1872 wrote to memory of 2576	1872	dddddd.exe	40
PID 1872 wrote to memory of 2576	1872	dddddd.exe	40
PID 1872 wrote to memory of 2576	1872	dddddd.exe	40
PID 2576 wrote to memory of 1916	2576	dddddd.exe	41
PID 2576 wrote to memory of 1916	2576	dddddd.exe	41
PID 2576 wrote to memory of 1916	2576	dddddd.exe	41
PID 2576 wrote to memory of 1916	2576	dddddd.exe	41
PID 1916 wrote to memory of 2024	1916	dddddd.exe	42
PID 1916 wrote to memory of 2024	1916	dddddd.exe	42
PID 1916 wrote to memory of 2024	1916	dddddd.exe	42
PID 1916 wrote to memory of 2024	1916	dddddd.exe	42
PID 2024 wrote to memory of 2208	2024	dddddd.exe	43
PID 2024 wrote to memory of 2208	2024	dddddd.exe	43
PID 2024 wrote to memory of 2208	2024	dddddd.exe	43
PID 2024 wrote to memory of 2208	2024	dddddd.exe	43
PID 2208 wrote to memory of 2164	2208	dddddd.exe	44
PID 2208 wrote to memory of 2164	2208	dddddd.exe	44
PID 2208 wrote to memory of 2164	2208	dddddd.exe	44
PID 2208 wrote to memory of 2164	2208	dddddd.exe	44
PID 2164 wrote to memory of 564	2164	dddddd.exe	45
PID 2164 wrote to memory of 564	2164	dddddd.exe	45
PID 2164 wrote to memory of 564	2164	dddddd.exe	45
PID 2164 wrote to memory of 564	2164	dddddd.exe	45

C:\Users\Admin\AppData\Local\Temp\354b34a3694e2b4d54ba3bca624aa3c3.exe
"C:\Users\Admin\AppData\Local\Temp\354b34a3694e2b4d54ba3bca624aa3c3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\AppData\Local\directory\dddddd.exe
  "C:\Users\Admin\AppData\Local\Temp\354b34a3694e2b4d54ba3bca624aa3c3.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\directory\dddddd.exe
    "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\directory\dddddd.exe
      "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2872
      - C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:564
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:344
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:404
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        34⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:684
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        38⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        39⤵
        Executes dropped EXE
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        40⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        41⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        43⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        44⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        45⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        47⤵
        Executes dropped EXE
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:464
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        49⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        50⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        51⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        54⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        55⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        56⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        57⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        59⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        60⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        61⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        62⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        63⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        64⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        65⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        66⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        67⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        68⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        69⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        70⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        71⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        72⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        73⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        74⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        75⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        78⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        79⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        80⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        81⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        85⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        86⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        88⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        90⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        91⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        93⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        94⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        95⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        96⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:348
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        98⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        99⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        100⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        101⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        102⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        103⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        104⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        105⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        106⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        107⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        108⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        110⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        112⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        114⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        115⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        116⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        117⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        118⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        119⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        120⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        121⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        122⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        123⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        124⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        125⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        127⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        128⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        131⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        135⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        136⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        138⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        139⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        140⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        141⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        142⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        143⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        144⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        145⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        146⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        147⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        149⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        150⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        151⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        152⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        153⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        156⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        157⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        158⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        159⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        160⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        161⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        162⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        163⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        165⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        166⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        167⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        168⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        169⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        170⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        171⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        172⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        174⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        175⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:264
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        180⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        181⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        182⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        184⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        186⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        187⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        189⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        190⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        191⤵
        
        PID:604
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        192⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        193⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        194⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        195⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        196⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        197⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        198⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        200⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        201⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        202⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        203⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        204⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        205⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        207⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        208⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        210⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        211⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        213⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        214⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        215⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        216⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        217⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        218⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        219⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        220⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        221⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        223⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        226⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        227⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        228⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        231⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        233⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        234⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        235⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        236⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        239⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        240⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        241⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        242⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        243⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        244⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        245⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        246⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        247⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        248⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        249⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        250⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        251⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        252⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        254⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        256⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        257⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        258⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        259⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        260⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\directory\dddddd.exe
        
        "C:\Users\Admin\AppData\Local\directory\dddddd.exe"
        262⤵
        
        PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut6577.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut6577.tmp
Size 384KB
SHA256 02ef6f365d2d9e4ab97c80fe70d89f7b51cc5914a6756b17e1d372b40af25b44
MD5 4a528c9e55817786057cd2ab4271dac0
SHA1 2c0b82cb50af76330de89b69164b9a32f59ea5d8
SHA512 5e672a53bb82b881d3ad1c492a93096589e8a9c2ed920be5d1e5ef93453baded47db96be55b74a84547edcf33d95b0ae1b1c2aed5d2d103e26481960545c517c
SSDEEP 6144:JDyRvRU1Bs/lWH/HwWr1hMsjiAVcmRHu257PNLi2FlBVVub43S4C36Npr:JsvOIlWfHwuhMkxH3lLiuyb43S4C34
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut6597.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut6597.tmp
Size 10KB
SHA256 8927cfafaefe0cc666afbeefcb0c4558e67df5e184f30f6a6420bcfdafd6229d
MD5 794dd42e43c9f5f2a14a526c2c78e768
SHA1 4e31258ac80b9ecbdd8e9001c07378f2868b8350
SHA512 642254b6c1b3d414a239a431cff2910f8707d638aca5d7af03ad5fe655766b18cbf1e8f94f0593b9ffe3de17a4205e5762a2b244a336f91d30e4c0e6ea3d5c05
SSDEEP 192:RE7FGNNtmlNBngKgUnVX/IzJ93hEfu3/UzkLXEtyS9bHr/MbWVgKebMuYnTSS7Pa:RcGrtmlXxpnVX/IzJPEfy8z+UtyMdVyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

definitization

Path C:\Users\Admin\AppData\Local\Temp\definitization
Size 56KB
SHA256 88b06124dd503e93614f8dc3fd011565c949e2a36ecb44c0a9de685465330167
MD5 be57919a8e6f5c3d638c08144dfff614
SHA1 a096881aaea02eecc45536e041050cf08917b433
SHA512 8c6154154f3ee2ed6d19b6527f89ae3279fc64b0489baf415b1779cbe2af12d4f4cac2fd67e2c57a825639f86e8b4a72ca2ead831fe93bc90141a013bb4bbcf5
SSDEEP 384:ljTF4Z76n17h8tGvs6pZw1siK/8Dv0JCbva+Xv2P05GfW4:lnF4Z76n17iGbas1PJWvBXNo
MD5 SHA1 SHA512 SSDEEP

Submit Download

palladize

Path C:\Users\Admin\AppData\Local\Temp\palladize
Size 483KB
SHA256 35317bf8ab08c12751490059e9af81b8226b013401e9906ad109e49c1924d13f
MD5 f4461a02e25109973cdf62c9260edc73
SHA1 988eaf6cf392bc92f09c514a99db3b44bd9d0450
SHA512 f6d86a3f8702d89acc1c4cb63fbd81d03a8f86d8f43ce1a244343b59b6121416420c421e10830675dd970d97064ab2b7b422b60fe2658b263daf12f2932707dc
SSDEEP 12288:KFgmnCIpd9p9jmEAxo1V0gdsh5CRxfSoEFIhAgrrYx:KFgaCI3h1VVdshuFBETX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dddddd.exe

Path \Users\Admin\AppData\Local\directory\dddddd.exe
Size 1.2MB
SHA256 52e5414e2e8aabecfc1c38926a3d863e1ee26bef5dc8453fc0568d9f263cf384
MD5 354b34a3694e2b4d54ba3bca624aa3c3
SHA1 660ee183f7f7a17eace0556c8883a2c361424cb0
SHA512 f78bbbd45ee9dc147394f79c0aed2c8104c42116b72c653586ac0855d0c075e3b17571bc62e33ba055bcc91197f6e2a491e97ad35eab8f425bbf713a5e0b5870
SSDEEP 24576:+tb20pkaCqT5TBWgNQ7aLHWD2rmiOWlcIqDBZLAkxy06A:rVg5tQ7aLHWDd/B9A65
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-11-0x00000000000B0000-0x00000000000B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads