Overview

overview

10

Static

static

3

8ffa3acb67...14.exe

windows7-x64

10

8ffa3acb67...14.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2024 01:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814.exe

  • Size

    803KB

  • MD5

    47d08da30094ecebe28a42af6b172dc6

  • SHA1

    b0a56e72d5883818dbead15a30d2607adf76424a

  • SHA256

    8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814

  • SHA512

    028d198574399ef68b5e9e41faa979f546ef1250f8f13e91901e37270e5783ded3542605db15b28de9f95b5c88cd4ff28170d6c7be920b33b7b6df2caeb03940

  • SSDEEP

    24576:sY2gUfVH5XlVYzagW4/3rn0Y5zmzRf1P2MVMl:DENH5X3ngbrnL5yzpVM

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814.exe
    "C:\Users\Admin\AppData\Local\Temp\8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\3582-490\8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3472
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1384
            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5016
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2404
                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                  8⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1148
                  • C:\Windows\svchost.com
                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2712
                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2672
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3992
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:3548
                          • C:\Windows\svchost.com
                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1132
                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1604
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2932
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:3568
                                  • C:\Windows\svchost.com
                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3340
                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                      18⤵
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:1528
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4456
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:3212
                                          • C:\Windows\svchost.com
                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2604
                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:2908
                                              • C:\Windows\svchost.com
                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:2452
                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  • Modifies registry class
                                                  PID:5068
                                                  • C:\Windows\svchost.com
                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    PID:4172
                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:4368
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        PID:4628
                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                          28⤵
                                                          • Executes dropped EXE
                                                          PID:4840
                                                          • C:\Windows\svchost.com
                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            PID:2964
                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              PID:4428
                                                              • C:\Windows\svchost.com
                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1964
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:3124
                                                                  • C:\Windows\svchost.com
                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    PID:2576
                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      PID:2712
                                                                      • C:\Windows\svchost.com
                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2612
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          PID:2164
                                                                          • C:\Windows\svchost.com
                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4756
                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:2508
                                                                              • C:\Windows\svchost.com
                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                PID:1104
                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2924
                                                                                  • C:\Windows\svchost.com
                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1084
                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in Windows directory
                                                                                      PID:4604
                                                                                      • C:\Windows\svchost.com
                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        PID:2128
                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          PID:2148
                                                                                          • C:\Windows\svchost.com
                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            PID:3212
                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4276
                                                                                              • C:\Windows\svchost.com
                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3768
                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies registry class
                                                                                                  PID:1960
                                                                                                  • C:\Windows\svchost.com
                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2848
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1772
                                                                                                      • C:\Windows\svchost.com
                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:5068
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5028
                                                                                                          • C:\Windows\svchost.com
                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3284
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:3348
                                                                                                              • C:\Windows\svchost.com
                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4424
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                  56⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Modifies registry class
                                                                                                                  PID:4996
                                                                                                                  • C:\Windows\svchost.com
                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:4616
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2368
                                                                                                                      • C:\Windows\svchost.com
                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2144
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3112
                                                                                                                          • C:\Windows\svchost.com
                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:1316
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:848
                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1996
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3260
                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:3316
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                      66⤵
                                                                                                                                        PID:3964
                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                          67⤵
                                                                                                                                            PID:3408
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                              68⤵
                                                                                                                                                PID:4512
                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                  69⤵
                                                                                                                                                    PID:812
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                      70⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:5036
                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                        71⤵
                                                                                                                                                          PID:2644
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                            72⤵
                                                                                                                                                              PID:3552
                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                73⤵
                                                                                                                                                                  PID:2484
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                    74⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:3272
                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                      75⤵
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3512
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                        76⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:1528
                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                          77⤵
                                                                                                                                                                            PID:3448
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                              78⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              PID:1680
                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                79⤵
                                                                                                                                                                                  PID:3212
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                    80⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2852
                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                      81⤵
                                                                                                                                                                                        PID:1072
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                          82⤵
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:3948
                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                            83⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:1520
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                              84⤵
                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                    PID:760
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:3660
                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3472
                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                      PID:228
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:2056
                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                            PID:840
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              PID:4048
                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                              PID:4964
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                          PID:812
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2660
                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                  PID:2264
                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        PID:5008
                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                              PID:1528
                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:5108
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3768
                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                                      PID:2408
                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:760
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:740
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                      PID:3476
                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:228
                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:2056
                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                    PID:4204
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                          PID:4796
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:1564
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                                                PID:1032
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4392
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1240
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          PID:5076
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                                              PID:924
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:392
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3132
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4060
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\8FFA3A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4816
                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1996

                                                                                                                                                                                                    Network

                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      368KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      eeb875c0b3c567ce160b6065fa9955c0

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ee0e1efba40d38746a54bc285f0bd38198550564

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      995bd211c7e3bb5e6ed86064d2c648537b2c5c058f3ca81ab9307cdb0ac2530a

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      416bece422edd84337b789bdbd1e3f888d67dfe1dabbd114ebf07b968d68b848cc10880c2ad439413b47cf1191c273125130399bcc9c4a2ed5719553c51c3ad6

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      2.4MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d9e8a1fa55faebd36ed2342fedefbedd

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      c25cc7f0035488de9c5df0121a09b5100e1c28e9

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      131KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      514972e16cdda8b53012ad8a14a26e60

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      aa082c2fbe0b3dd5c47952f9a285636412203559

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      98bbd6f06e3ff3e94aee3620f20f89e254dde157bc8129a64cf78fefe5cf9b13c7902128c2acbd54b3def527e09a039bd1f66ba64efb85f3f0404d894cabbee4

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      454KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      961c73fd70b543a6a3c816649e5f8fce

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      8dbdc7daeb83110638d192f65f6d014169e0a79b

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      e5d97ee63b02abc65add41f6721514515b34fd79f7db23ae04cf608c2f7e0504e00b07694047b982d14d60cccf6f833b50268c693e3baf1b697d3370c0bba0b6

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      595KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      c3c9aa04ba87f6759a557db06341f8be

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ebb57b17b62fdc896f1f272ce41e3b7b3d397ee1

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      037ef9ddd200ff48535aeb2d6bd0f97e7113c5ae9fb79ad90e4018a0467e35ac

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      85978bcad611921d70c0552ea1c904de8f16213694e1e0e339a769a2d73694ff9fd247dc7f4e08960ba99d2e9c5e3880b3e5e56aeaafd1607a60c7a10a8cb9da

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      366KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      75dbb8ccc95969068e221b7292f50888

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      c87ee029a84d2c021ce5d816b32a9d7d55c914d4

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      6b2fdb20eab37b1faec1a92358d05ca2ee050fd824add15b0f1de7ee47999185

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      66e8a79990a38a4a7b7d6366383eb23cbc9bf522c1354193d04d7442a7d72356e9d7f1b84459724c800dda79fac438f35756aa1e8465b1dc8d870792cca1c831

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      325KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      de9e6086062f01926b48c2d80508d12b

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      13610cca5e38925e22b6a79067df0dd9eca49fe3

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      60478e55b6a3d49686ed8e95e939a2384fb1440950d710e7beedb9eda24be0e6996c931d0703d6cc0065fbe5a85eff463b9e9eaadf14746593abe723636137c3

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      546KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d705ccf8df250903be531a1a0a908571

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      38782ec5e2658421f9622bd3c27262d388baeaae

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      5e1feee8cd7ab462197ddc9c385a78f6a11d6f5718886ea9bf49eb425622c799

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      43acd0aab50e781e311636891e5e3ffd5bf257cc489b13c1aefb2b3f084da4c8712b7fa45c1bc5e9551b8ddc6eeafe74476a9002fa12af052fe27e6421e5ad94

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\8ffa3acb6719dd908f5e3ca114ed6b961691da2464bbf304152b8df8e2040814.exe
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      763KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      aaae1ea5782d87f6665bb65a3c8d69cc

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      23a4d8478730a2c7e65ed1d5a9db16fa3eeb9d31

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      9d0a75a3230065a5bf3c711d3190e4669cf90071b344f51c6f10ff140f94e378

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      6ed0bbf49f5b493d30860cc81023aae325a29e228bfa2e2af29ac1d6a877ae9779316d0d29a66482291b382bc333ee34975f6e22cae4155679c8f253b8b6f7bd

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\Windows\directx.sys
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      57B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      977ac6df7e99df1a1921bba4b3890efa

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      21cced3381eb326cb91741d8d37e83ada25935ac

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      e693798d50addb43af42e5e51b1836887e7a81ad5bc5253e18445290b0f045b0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      cbcdae4a87be25fa52c0a9c45b90070fad5818a1c31a5877762ec5a043a3f176559f240baf2cf6ea4db2dec740fbee6792377b9c1145ac248145a1b9f3f48c18

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      40KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      2f50aca08ffc461c86e8fb5bbedda142

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      6fc5319d084c6e13f950c24c78a9cadb7793c638

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      d60208f3894f4556caae5ed2297c0ef1593a4a66f5af8f3f2e44a8f2896bbf8e

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      785225fe823c5724c7ebbfb17f31ffcfc2b3b852369b4d3e002b54476ad8c0f4a5d6ac29d43886361bc8deda29db9f9ce70b1e4496b08390a8ead50ddac9d46e

                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                    • memory/848-415-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1084-324-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1104-314-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1132-77-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1148-51-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1316-408-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1384-29-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1528-112-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1604-81-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1772-362-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1960-354-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1964-252-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/1996-416-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2128-333-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2144-400-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2144-17-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2148-343-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2164-289-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2368-394-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2404-41-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2452-159-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2508-305-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2576-270-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2604-125-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2612-282-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2672-64-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2712-277-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2712-53-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2848-360-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2908-144-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2924-318-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2932-89-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/2964-213-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3112-404-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3124-268-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3212-344-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3212-123-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3260-418-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3284-377-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3316-424-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3340-101-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3348-378-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3472-28-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3548-69-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3568-100-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3768-352-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3964-431-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/3992-65-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4172-171-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4276-346-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4368-182-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4424-384-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4428-231-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4456-113-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4604-326-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4616-392-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4628-183-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4756-303-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4840-195-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/4996-386-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5016-39-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5028-375-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5068-169-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download

                                                                                                                                                                                                    • memory/5068-368-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      108KB

                                                                                                                                                                                                      Download