560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Size

1.4MB
MD5

c7fc0cee8ca35d709ed276e9f88ddbed
SHA1

ceea9d76bf0429872f4d7420addd0abdb5e8f4dc
SHA256

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e
SHA512

a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da
SSDEEP

24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aIHo9Hi9Yc1St1R1M9p09oMMhDIGL0:2TvC/MTQYxsWR7aIHEC+coJ1OpwoMMhv

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs	RegAsymX.exe

Executes dropped EXE 64 IoCs

pid	Process
2780	RegAsymX.exe
2880	RegAsymX.exe
2556	RegAsymX.exe
3008	RegAsymX.exe
836	RegAsymX.exe
2400	RegAsymX.exe
2868	RegAsymX.exe
2324	RegAsymX.exe
2840	RegAsymX.exe
1708	RegAsymX.exe
1904	RegAsymX.exe
2388	RegAsymX.exe
2000	RegAsymX.exe
2988	RegAsymX.exe
1600	RegAsymX.exe
356	RegAsymX.exe
1532	RegAsymX.exe
2884	RegAsymX.exe
2112	RegAsymX.exe
1720	RegAsymX.exe
2068	RegAsymX.exe
2900	RegAsymX.exe
2236	RegAsymX.exe
2804	RegAsymX.exe
2680	RegAsymX.exe
2552	RegAsymX.exe
2676	RegAsymX.exe
1484	RegAsymX.exe
2396	RegAsymX.exe
2924	RegAsymX.exe
1616	RegAsymX.exe
688	RegAsymX.exe
1924	RegAsymX.exe
2020	RegAsymX.exe
1288	RegAsymX.exe
2964	RegAsymX.exe
1784	RegAsymX.exe
2732	RegAsymX.exe
3020	RegAsymX.exe
1080	RegAsymX.exe
624	RegAsymX.exe
2352	RegAsymX.exe
396	RegAsymX.exe
1256	RegAsymX.exe
2500	RegAsymX.exe
1048	RegAsymX.exe
1584	RegAsymX.exe
2704	RegAsymX.exe
2820	RegAsymX.exe
1056	RegAsymX.exe
1776	RegAsymX.exe
2384	RegAsymX.exe
2392	RegAsymX.exe
2984	RegAsymX.exe
1940	RegAsymX.exe
2856	RegAsymX.exe
2188	RegAsymX.exe
2152	RegAsymX.exe
2904	RegAsymX.exe
1512	RegAsymX.exe
2996	RegAsymX.exe
1856	RegAsymX.exe
824	RegAsymX.exe
1520	RegAsymX.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000017487-13.dat	autoit_exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2780	RegAsymX.exe
2780	RegAsymX.exe
2880	RegAsymX.exe
2880	RegAsymX.exe
2556	RegAsymX.exe
2556	RegAsymX.exe
3008	RegAsymX.exe
3008	RegAsymX.exe
836	RegAsymX.exe
836	RegAsymX.exe
2400	RegAsymX.exe
2400	RegAsymX.exe
2868	RegAsymX.exe
2868	RegAsymX.exe
2324	RegAsymX.exe
2324	RegAsymX.exe
2840	RegAsymX.exe
2840	RegAsymX.exe
1708	RegAsymX.exe
1708	RegAsymX.exe
1904	RegAsymX.exe
1904	RegAsymX.exe
2388	RegAsymX.exe
2388	RegAsymX.exe
2000	RegAsymX.exe
2000	RegAsymX.exe
2988	RegAsymX.exe
2988	RegAsymX.exe
1600	RegAsymX.exe
1600	RegAsymX.exe
356	RegAsymX.exe
356	RegAsymX.exe
1532	RegAsymX.exe
1532	RegAsymX.exe
2884	RegAsymX.exe
2884	RegAsymX.exe
2112	RegAsymX.exe
2112	RegAsymX.exe
1720	RegAsymX.exe
1720	RegAsymX.exe
2068	RegAsymX.exe
2068	RegAsymX.exe
2900	RegAsymX.exe
2900	RegAsymX.exe
2236	RegAsymX.exe
2236	RegAsymX.exe
2804	RegAsymX.exe
2804	RegAsymX.exe
2680	RegAsymX.exe
2680	RegAsymX.exe
2552	RegAsymX.exe
2552	RegAsymX.exe
2676	RegAsymX.exe
2676	RegAsymX.exe
1484	RegAsymX.exe
1484	RegAsymX.exe
2396	RegAsymX.exe
2396	RegAsymX.exe
2924	RegAsymX.exe
2924	RegAsymX.exe
1616	RegAsymX.exe
1616	RegAsymX.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2780	RegAsymX.exe
2780	RegAsymX.exe
2880	RegAsymX.exe
2880	RegAsymX.exe
2556	RegAsymX.exe
2556	RegAsymX.exe
3008	RegAsymX.exe
3008	RegAsymX.exe
836	RegAsymX.exe
836	RegAsymX.exe
2400	RegAsymX.exe
2400	RegAsymX.exe
2868	RegAsymX.exe
2868	RegAsymX.exe
2324	RegAsymX.exe
2324	RegAsymX.exe
2840	RegAsymX.exe
2840	RegAsymX.exe
1708	RegAsymX.exe
1708	RegAsymX.exe
1904	RegAsymX.exe
1904	RegAsymX.exe
2388	RegAsymX.exe
2388	RegAsymX.exe
2000	RegAsymX.exe
2000	RegAsymX.exe
2988	RegAsymX.exe
2988	RegAsymX.exe
1600	RegAsymX.exe
1600	RegAsymX.exe
356	RegAsymX.exe
356	RegAsymX.exe
1532	RegAsymX.exe
1532	RegAsymX.exe
2884	RegAsymX.exe
2884	RegAsymX.exe
2112	RegAsymX.exe
2112	RegAsymX.exe
1720	RegAsymX.exe
1720	RegAsymX.exe
2068	RegAsymX.exe
2068	RegAsymX.exe
2900	RegAsymX.exe
2900	RegAsymX.exe
2236	RegAsymX.exe
2236	RegAsymX.exe
2804	RegAsymX.exe
2804	RegAsymX.exe
2680	RegAsymX.exe
2680	RegAsymX.exe
2552	RegAsymX.exe
2552	RegAsymX.exe
2676	RegAsymX.exe
2676	RegAsymX.exe
1484	RegAsymX.exe
1484	RegAsymX.exe
2396	RegAsymX.exe
2396	RegAsymX.exe
2924	RegAsymX.exe
2924	RegAsymX.exe
1616	RegAsymX.exe
1616	RegAsymX.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2780	2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	30
PID 2364 wrote to memory of 2780	2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	30
PID 2364 wrote to memory of 2780	2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	30
PID 2364 wrote to memory of 2780	2364	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	30
PID 2780 wrote to memory of 2880	2780	RegAsymX.exe	31
PID 2780 wrote to memory of 2880	2780	RegAsymX.exe	31
PID 2780 wrote to memory of 2880	2780	RegAsymX.exe	31
PID 2780 wrote to memory of 2880	2780	RegAsymX.exe	31
PID 2880 wrote to memory of 2556	2880	RegAsymX.exe	32
PID 2880 wrote to memory of 2556	2880	RegAsymX.exe	32
PID 2880 wrote to memory of 2556	2880	RegAsymX.exe	32
PID 2880 wrote to memory of 2556	2880	RegAsymX.exe	32
PID 2556 wrote to memory of 3008	2556	RegAsymX.exe	33
PID 2556 wrote to memory of 3008	2556	RegAsymX.exe	33
PID 2556 wrote to memory of 3008	2556	RegAsymX.exe	33
PID 2556 wrote to memory of 3008	2556	RegAsymX.exe	33
PID 3008 wrote to memory of 836	3008	RegAsymX.exe	34
PID 3008 wrote to memory of 836	3008	RegAsymX.exe	34
PID 3008 wrote to memory of 836	3008	RegAsymX.exe	34
PID 3008 wrote to memory of 836	3008	RegAsymX.exe	34
PID 836 wrote to memory of 2400	836	RegAsymX.exe	35
PID 836 wrote to memory of 2400	836	RegAsymX.exe	35
PID 836 wrote to memory of 2400	836	RegAsymX.exe	35
PID 836 wrote to memory of 2400	836	RegAsymX.exe	35
PID 2400 wrote to memory of 2868	2400	RegAsymX.exe	36
PID 2400 wrote to memory of 2868	2400	RegAsymX.exe	36
PID 2400 wrote to memory of 2868	2400	RegAsymX.exe	36
PID 2400 wrote to memory of 2868	2400	RegAsymX.exe	36
PID 2868 wrote to memory of 2324	2868	RegAsymX.exe	37
PID 2868 wrote to memory of 2324	2868	RegAsymX.exe	37
PID 2868 wrote to memory of 2324	2868	RegAsymX.exe	37
PID 2868 wrote to memory of 2324	2868	RegAsymX.exe	37
PID 2324 wrote to memory of 2840	2324	RegAsymX.exe	38
PID 2324 wrote to memory of 2840	2324	RegAsymX.exe	38
PID 2324 wrote to memory of 2840	2324	RegAsymX.exe	38
PID 2324 wrote to memory of 2840	2324	RegAsymX.exe	38
PID 2840 wrote to memory of 1708	2840	RegAsymX.exe	39
PID 2840 wrote to memory of 1708	2840	RegAsymX.exe	39
PID 2840 wrote to memory of 1708	2840	RegAsymX.exe	39
PID 2840 wrote to memory of 1708	2840	RegAsymX.exe	39
PID 1708 wrote to memory of 1904	1708	RegAsymX.exe	40
PID 1708 wrote to memory of 1904	1708	RegAsymX.exe	40
PID 1708 wrote to memory of 1904	1708	RegAsymX.exe	40
PID 1708 wrote to memory of 1904	1708	RegAsymX.exe	40
PID 1904 wrote to memory of 2388	1904	RegAsymX.exe	41
PID 1904 wrote to memory of 2388	1904	RegAsymX.exe	41
PID 1904 wrote to memory of 2388	1904	RegAsymX.exe	41
PID 1904 wrote to memory of 2388	1904	RegAsymX.exe	41
PID 2388 wrote to memory of 2000	2388	RegAsymX.exe	42
PID 2388 wrote to memory of 2000	2388	RegAsymX.exe	42
PID 2388 wrote to memory of 2000	2388	RegAsymX.exe	42
PID 2388 wrote to memory of 2000	2388	RegAsymX.exe	42
PID 2000 wrote to memory of 2988	2000	RegAsymX.exe	43
PID 2000 wrote to memory of 2988	2000	RegAsymX.exe	43
PID 2000 wrote to memory of 2988	2000	RegAsymX.exe	43
PID 2000 wrote to memory of 2988	2000	RegAsymX.exe	43
PID 2988 wrote to memory of 1600	2988	RegAsymX.exe	44
PID 2988 wrote to memory of 1600	2988	RegAsymX.exe	44
PID 2988 wrote to memory of 1600	2988	RegAsymX.exe	44
PID 2988 wrote to memory of 1600	2988	RegAsymX.exe	44
PID 1600 wrote to memory of 356	1600	RegAsymX.exe	45
PID 1600 wrote to memory of 356	1600	RegAsymX.exe	45
PID 1600 wrote to memory of 356	1600	RegAsymX.exe	45
PID 1600 wrote to memory of 356	1600	RegAsymX.exe	45

C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
"C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
  "C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
    "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
      "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3008
      - C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:356
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:688
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        36⤵
        Executes dropped EXE
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        37⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        38⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        40⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        41⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:624
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        43⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        44⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        47⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        48⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        49⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        51⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        52⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        54⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        55⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        56⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        58⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        59⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        60⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        64⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        65⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        67⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        68⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        69⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        70⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        71⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        72⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        73⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        74⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        76⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        79⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        81⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        82⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        83⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        84⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:604
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        87⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        88⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        89⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        90⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        91⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        92⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        93⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        96⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        98⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        100⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        102⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        103⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        104⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        105⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        106⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        107⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        108⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        109⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        110⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        111⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        112⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        114⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        115⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        116⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        118⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        120⤵
        
        PID:292
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        121⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        123⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        125⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        126⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        127⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        128⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        130⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        131⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        132⤵
        
        PID:300
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        133⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        134⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        135⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        138⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        139⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        140⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        141⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        142⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        146⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        147⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        148⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        149⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        150⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        151⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        152⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        153⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        154⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        155⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        157⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        158⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        159⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        160⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        161⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        162⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:304
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        164⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        166⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        167⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        168⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        169⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        172⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        174⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        175⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        177⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        178⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        179⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        182⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        183⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        184⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        185⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        186⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        189⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        190⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        191⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        193⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        194⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        195⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        199⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        200⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        202⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        204⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        205⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        207⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        210⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        211⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        212⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        213⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        214⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        215⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        216⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        217⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        218⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        219⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        220⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        221⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
        
        "C:\Users\Admin\AppData\Local\directory\RegAsymX.exe"
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Lymnaeidae

Filesize
84KB

MD5
e9d80ff6fcd8ceeb2f0c63b6d84354fd

SHA1
9e697f748635834b3b88f33fbb77323261b325b0

SHA256
91f5f7478ffcd500ad50e86ada1faffc60979b449af4d56b3bf1f71bb7da0a3d

SHA512
aba78fb40aae7238b20ba9fbe9d975481da595896a651962c41b89f6bea323a7040afaf35a33f0608a4f2d0aaf899537a5e1cc37887afc6ece0e468f9916b343

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut1574.tmp

Filesize
408KB

MD5
ce86f406e025ab6c2d4619b42b06a10f

SHA1
910ec8a487315a88f37d98e65c61886bfb6e5a8d

SHA256
c74e9a1bc00368e1cce005364c3b8ec3822241d895febc6f018491ea368e6464

SHA512
6b999d9b150eb8b6ecbb37a4b0f3e0a0246a97bce310044bdd90926945a4fd6942bfece1b0f64c57108834efc63a60feb48497db2d4a1a7ded076dc1fe162665

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut15A4.tmp

Filesize
42KB

MD5
82867b0c21d8c24cf50c4408d8f9821b

SHA1
08cdc310e08ae5e72502e4077134bb6de08f3739

SHA256
900638a4da24c03753d210ea0c53ff6d729c04563c67b533c5e4f5271f4a3fd5

SHA512
f416f2e257caa70d47f152958c95f3f71443afbdd1e641b37ae0ca5d15954f19d8f0461fe035dd3a23afcb6d5e8c62577ae33aa192e35da3af3922bd868f2e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ophiolatrous

Filesize
483KB

MD5
89669f54c2cf58a12e6eb05f0b0c8b45

SHA1
9dd08035fb240b2d8c284c31786f20c04e4d871a

SHA256
7367a34c0b9d0c68678b8bd5bd02a54c94d7a60000aabc0525079b641c0f5e03

SHA512
000188de8af2c2886ab5085890835e29cf0e65f6c9fc01a52f47a709650d8c9f411bb8931e545c27edc132ee14fa685ec063d5681bffd9ece56a52473e9f2686

Download Submit
\Users\Admin\AppData\Local\directory\RegAsymX.exe

Filesize
1.4MB

MD5
c7fc0cee8ca35d709ed276e9f88ddbed

SHA1
ceea9d76bf0429872f4d7420addd0abdb5e8f4dc

SHA256
560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

SHA512
a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da

Download Submit
memory/2364-11-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download