Overview

overview

10

Static

static

3

cc04763f7f...18.exe

windows7-x64

10

cc04763f7f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 01:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc04763f7fd3d1b969fbb27ac9e8fd9b_JaffaCakes118.exe

  • Size

    99KB

  • MD5

    cc04763f7fd3d1b969fbb27ac9e8fd9b

  • SHA1

    84186e9ef9a714ba212aebd28e6f9e1f4d3abff0

  • SHA256

    a524b24270992d676b525fe1b717ceffa34cf0653c9984024198f5da44e952ee

  • SHA512

    be79f98a183c0769ad2211b5f6571d9430bf491d7e9db7dd59e78f5510cbc414d047a221f667230ae8464311dc6f6f946ce51f9078d93b365fa482499ba18a66

  • SSDEEP

    3072:iljvybGUlB8/Pwx5AYAzGt5N1UcAjxd7:il+QxlzG1mr

Score
10/10
hawkeyextremeratdiscoverykeyloggerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat
  • Renames multiple (258) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc04763f7fd3d1b969fbb27ac9e8fd9b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cc04763f7fd3d1b969fbb27ac9e8fd9b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          4⤵
            PID:4660
        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4908
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
            dw20.exe -x -s 920
            4⤵
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            PID:3268
          • C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
            "C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:400
            • C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
              C:\Users\Admin\AppData\Local\Temp\System\wmiapsvrd.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:692
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                6⤵
                  PID:3144
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:364
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:776
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2012
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:812
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1440
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3608
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 904
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3248
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3784
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1488
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4264
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 892
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3252
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:968
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2256
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2188
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4424
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4336
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 896
                  6⤵
                  • Checks processor information in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4640
              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3720
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                  dw20.exe -x -s 884
                  6⤵
                    PID:3608
                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2988
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                    dw20.exe -x -s 884
                    6⤵
                      PID:2924
                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:364
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                      dw20.exe -x -s 884
                      6⤵
                        PID:2080
                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4016
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                        dw20.exe -x -s 884
                        6⤵
                          PID:3256
                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:976
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                          dw20.exe -x -s 884
                          6⤵
                            PID:4444
                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:1640
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                            dw20.exe -x -s 884
                            6⤵
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:4584
                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:5104
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                            dw20.exe -x -s 884
                            6⤵
                              PID:2200
                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:4160
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                              dw20.exe -x -s 884
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4276
                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:4084
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                              dw20.exe -x -s 904
                              6⤵
                                PID:2652
                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1964
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                dw20.exe -x -s 884
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:4504
                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:4388
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                dw20.exe -x -s 884
                                6⤵
                                • Checks processor information in registry
                                PID:5084
                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:5092
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                dw20.exe -x -s 884
                                6⤵
                                • Checks processor information in registry
                                PID:1232
                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:3088
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                dw20.exe -x -s 904
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:3048
                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1600
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                dw20.exe -x -s 884
                                6⤵
                                  PID:5040
                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:2188
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                  dw20.exe -x -s 884
                                  6⤵
                                  • Enumerates system info in registry
                                  PID:5024
                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:2072
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                  dw20.exe -x -s 884
                                  6⤵
                                    PID:4276
                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                  5⤵
                                    PID:4344
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                      dw20.exe -x -s 884
                                      6⤵
                                        PID:3580
                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                      5⤵
                                        PID:2652
                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                          dw20.exe -x -s 884
                                          6⤵
                                            PID:2340
                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3288
                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                            dw20.exe -x -s 884
                                            6⤵
                                            • Checks processor information in registry
                                            PID:4016
                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                          5⤵
                                            PID:2676
                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                              dw20.exe -x -s 884
                                              6⤵
                                                PID:388
                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                              5⤵
                                                PID:3736
                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                  dw20.exe -x -s 888
                                                  6⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Checks processor information in registry
                                                  PID:3484
                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                5⤵
                                                  PID:4092
                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                    dw20.exe -x -s 884
                                                    6⤵
                                                    • Enumerates system info in registry
                                                    PID:5088
                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                  5⤵
                                                    PID:4644
                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                      dw20.exe -x -s 884
                                                      6⤵
                                                        PID:2844
                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                      5⤵
                                                        PID:4368
                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                          dw20.exe -x -s 892
                                                          6⤵
                                                          • Checks processor information in registry
                                                          PID:2116
                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                        5⤵
                                                          PID:2256
                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                            dw20.exe -x -s 892
                                                            6⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Enumerates system info in registry
                                                            PID:1740
                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                          5⤵
                                                            PID:1760
                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                              dw20.exe -x -s 904
                                                              6⤵
                                                                PID:364
                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                              5⤵
                                                                PID:2696
                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                  dw20.exe -x -s 904
                                                                  6⤵
                                                                  • Checks processor information in registry
                                                                  PID:232
                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                5⤵
                                                                  PID:1720
                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                    dw20.exe -x -s 884
                                                                    6⤵
                                                                      PID:3120
                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                    5⤵
                                                                      PID:4500
                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                        dw20.exe -x -s 884
                                                                        6⤵
                                                                        • Enumerates system info in registry
                                                                        PID:3152
                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                      5⤵
                                                                        PID:2072
                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                          dw20.exe -x -s 892
                                                                          6⤵
                                                                          • Enumerates system info in registry
                                                                          PID:2708
                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                        5⤵
                                                                          PID:3612
                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                            dw20.exe -x -s 884
                                                                            6⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Checks processor information in registry
                                                                            PID:3588
                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                          5⤵
                                                                            PID:4720
                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                              dw20.exe -x -s 892
                                                                              6⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Enumerates system info in registry
                                                                              PID:4540
                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                            5⤵
                                                                              PID:4208
                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                dw20.exe -x -s 884
                                                                                6⤵
                                                                                  PID:4132
                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                5⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1904
                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                  dw20.exe -x -s 904
                                                                                  6⤵
                                                                                    PID:5084
                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                  5⤵
                                                                                    PID:232
                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                      dw20.exe -x -s 884
                                                                                      6⤵
                                                                                        PID:2752
                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                      5⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3048
                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                        dw20.exe -x -s 888
                                                                                        6⤵
                                                                                        • Checks processor information in registry
                                                                                        • Enumerates system info in registry
                                                                                        PID:4128
                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                      5⤵
                                                                                        PID:4384
                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                          dw20.exe -x -s 884
                                                                                          6⤵
                                                                                          • Enumerates system info in registry
                                                                                          PID:3348
                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                        5⤵
                                                                                          PID:3432
                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                            dw20.exe -x -s 888
                                                                                            6⤵
                                                                                              PID:520
                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                            5⤵
                                                                                              PID:2080
                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                dw20.exe -x -s 884
                                                                                                6⤵
                                                                                                  PID:3312
                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                5⤵
                                                                                                  PID:3612
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                    dw20.exe -x -s 884
                                                                                                    6⤵
                                                                                                      PID:4572
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                    5⤵
                                                                                                      PID:5040
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                        dw20.exe -x -s 884
                                                                                                        6⤵
                                                                                                          PID:2380
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                        5⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2512
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                          dw20.exe -x -s 884
                                                                                                          6⤵
                                                                                                          • Enumerates system info in registry
                                                                                                          PID:2484
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                        5⤵
                                                                                                          PID:2816
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                            dw20.exe -x -s 904
                                                                                                            6⤵
                                                                                                              PID:4128
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                            5⤵
                                                                                                              PID:2016
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                dw20.exe -x -s 884
                                                                                                                6⤵
                                                                                                                  PID:1220
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                5⤵
                                                                                                                  PID:4496
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                    dw20.exe -x -s 884
                                                                                                                    6⤵
                                                                                                                      PID:1076
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                    5⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1476
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                      dw20.exe -x -s 884
                                                                                                                      6⤵
                                                                                                                        PID:4912
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                      5⤵
                                                                                                                        PID:3256
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                          dw20.exe -x -s 884
                                                                                                                          6⤵
                                                                                                                            PID:2448
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                          5⤵
                                                                                                                            PID:2596
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                              dw20.exe -x -s 884
                                                                                                                              6⤵
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:2096
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                            5⤵
                                                                                                                              PID:744
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                dw20.exe -x -s 892
                                                                                                                                6⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:436
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                              5⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4592
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                dw20.exe -x -s 900
                                                                                                                                6⤵
                                                                                                                                  PID:1496
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:3268
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                    6⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    PID:4664
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:5076
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                      dw20.exe -x -s 892
                                                                                                                                      6⤵
                                                                                                                                        PID:4960
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                      5⤵
                                                                                                                                        PID:4668
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                          6⤵
                                                                                                                                            PID:1856
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:4712
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                              6⤵
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              PID:1276
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                            5⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3516
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                              6⤵
                                                                                                                                                PID:4016
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:996
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                  dw20.exe -x -s 892
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2380
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4352
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                      6⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:736
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:3952
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                        6⤵
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:5060
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:3196
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                          6⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1388
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:4128
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                            dw20.exe -x -s 896
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1888
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:3580
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                dw20.exe -x -s 892
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4504
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:1788
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                    PID:2708
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:1376
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                      dw20.exe -x -s 888
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                      PID:3312
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4620
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                        PID:3968
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:4328
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                          dw20.exe -x -s 892
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                          PID:4508
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:1192
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                            PID:3736
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1844
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:1364
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4048
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                  PID:3924
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:2916
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:4172
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1652
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:3460
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1896
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                        dw20.exe -x -s 900
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:1952
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:4480
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                            PID:1308
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3312
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2652
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:4208
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:2564
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:4620
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:2484
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:2056
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:1220
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                              dw20.exe -x -s 892
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                              PID:1188
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:3200
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:3868
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                    dw20.exe -x -s 888
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                          dw20.exe -x -s 896
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2676
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:1464
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                dw20.exe -x -s 892
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1876
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                  PID:2592
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:532
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:3204
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:3636
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:3096
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:3516
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:996
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:4068
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                    dw20.exe -x -s 888
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                    PID:4872
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                      dw20.exe -x -s 888
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                        dw20.exe -x -s 904
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:1740
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                            dw20.exe -x -s 892
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                              dw20.exe -x -s 892
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:2700
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                  dw20.exe -x -s 904
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                  PID:1300
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:1952
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                    PID:232
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                      dw20.exe -x -s 892
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:1552
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:912
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2816
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:4080
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:4516
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                          dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:2960
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                              PID:1896
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:2256
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:3572
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:908
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                        PID:996
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:1888
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                              PID:1488
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:1652
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:2316
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 908
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:448
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:2904
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                PID:2508
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 896
                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:2204
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3608
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:180
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:2644
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                              PID:2228
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                PID:1856
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:736
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:732
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:4708
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:4132
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:4664
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:232
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:3256
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:2804
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:652
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:964
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                PID:5088
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                  PID:1212
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1492
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    PID:2328
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2596
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                      PID:2188
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    PID:5116
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                      PID:1020
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2216
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3584
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3472
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          PID:3608
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1156
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              PID:2104
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                  PID:2116
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                PID:1352
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                  PID:2024
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                PID:2752
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:968
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4192
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1192
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                      PID:436
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                    PID:928
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1188
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                          PID:2988
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4516
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2924
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3516
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2200
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1996
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4748
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                              PID:744
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:388
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2224

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            84B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            c35c9219a708c8e6dbe89049f200ceaf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2ab9b516c2216c6c1bc3cbad9b78fdfa29500535

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1e92675fcc3916c463d8097d0473bae8957fe405da0c8ba09741907253e71a0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            fd8213d5e9998de109c4082823504a0c01a57d75d202ffc8f4682623967735a5f4c6e688a340a32c3ecd0b5bb8cb7142fe9671d30bf9568f781cb9e2e129c141

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\System\audiadg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            22KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4a109a3a9a6d16c91df0c9cb7fc13387

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1b97703369e22ba433b7b817f9eeed3431ebd2e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            646e9448a3498be89f3053003b334a6e933134444cee32c6fa8be47fd477dc8e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            616c9adaeccf6f738401a4e2a45ecf14c1baa40aecf6ef3a89d32ec82c4cfd05f3964b80fdb470d94deb3b7fb4a1f3832427e6e2dccf997594d15a5e6cb97655

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cc04763f7fd3d1b969fbb27ac9e8fd9b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            84186e9ef9a714ba212aebd28e6f9e1f4d3abff0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            a524b24270992d676b525fe1b717ceffa34cf0653c9984024198f5da44e952ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            be79f98a183c0769ad2211b5f6571d9430bf491d7e9db7dd59e78f5510cbc414d047a221f667230ae8464311dc6f6f946ce51f9078d93b365fa482499ba18a66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/396-1-0x0000000074B10000-0x00000000750C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/396-2-0x0000000074B10000-0x00000000750C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/396-0-0x0000000074B12000-0x0000000074B13000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/396-17-0x0000000074B10000-0x00000000750C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/692-41-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/692-39-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/692-40-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3500-18-0x0000000074B10000-0x00000000750C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3500-19-0x0000000074B10000-0x00000000750C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3500-145-0x0000000074B10000-0x00000000750C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4528-28-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4528-27-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4528-26-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4528-23-0x0000000010000000-0x000000001004D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download