Overview

overview

10

Static

static

3

EU.exe

windows10-2004-x64

10

EU.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EU.exe

  • Size

    2.1MB

  • MD5

    84714242749ee3c7f626d1e9684e391a

  • SHA1

    f17abb2ab4ff1bb08360420c73e4d9496045ac1e

  • SHA256

    3c65766763fc26ba80bd11313a587f3e3206f9ba3fea6a39decd66a700cc9213

  • SHA512

    513010ecf933aaa85ae887b59aa03b8ddebc406cdd9ae3b889fdb2768ab33e363f81d17813e5caefe42e57162b45a81097a95723345e232b288be432150b4a28

  • SSDEEP

    49152:n2mx9FhsvlnBh5WYNo4QP6Dc3V0bO2EYTRIagYDitK/z5:n2m9WTNopCDc3V0bJE6RrHiE/z

Score
10/10
asyncratdefaultdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

193.161.193.99:53757

Mutex

hsaurcrgqwhjimnkbht

Attributes
  • delay

    1

  • install

    true

  • install_file

    Load.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Async RAT payload 1 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\EU.exe
    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Users\Admin\AppData\Local\Temp\Done.exe
      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ACCApi'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3120
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe" /st 12:58 /du 23:59 /sc daily /ri 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2348
      • C:\Users\Admin\AppData\Local\ACCApi\apihost.exe
        "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2956
    • C:\Users\Admin\AppData\Local\Temp\Load.exe
      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1688
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9EA1.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:3068
    • C:\Users\Admin\AppData\Local\Temp\EU.exe
      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Users\Admin\AppData\Local\Temp\Done.exe
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:552
      • C:\Users\Admin\AppData\Local\Temp\Load.exe
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4372
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA950.tmp.bat""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\system32\timeout.exe
            timeout 3
            5⤵
            • Delays execution with timeout.exe
            PID:3760
          • C:\Users\Admin\AppData\Roaming\Load.exe
            "C:\Users\Admin\AppData\Roaming\Load.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1508
      • C:\Users\Admin\AppData\Local\Temp\EU.exe
        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:764
        • C:\Users\Admin\AppData\Local\Temp\Done.exe
          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:960
        • C:\Users\Admin\AppData\Local\Temp\Load.exe
          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3180
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4744
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3148
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAFF7.tmp.bat""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4680
            • C:\Windows\system32\timeout.exe
              timeout 3
              6⤵
              • Delays execution with timeout.exe
              PID:3296
            • C:\Users\Admin\AppData\Roaming\Load.exe
              "C:\Users\Admin\AppData\Roaming\Load.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4248
        • C:\Users\Admin\AppData\Local\Temp\EU.exe
          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:824
          • C:\Users\Admin\AppData\Local\Temp\Done.exe
            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3704
          • C:\Users\Admin\AppData\Local\Temp\Load.exe
            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
              6⤵
                PID:4760
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:4320
            • C:\Users\Admin\AppData\Local\Temp\EU.exe
              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
              5⤵
              • Checks computer location settings
              PID:3292
              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4588
              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1520
              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                6⤵
                • Checks computer location settings
                PID:4220
                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1880
                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2560
                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                  7⤵
                  • Checks computer location settings
                  PID:452
                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3128
                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4040
                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                    8⤵
                    • Checks computer location settings
                    PID:2708
                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                      9⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5000
                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4444
                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                      9⤵
                      • Checks computer location settings
                      PID:5048
                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                        10⤵
                        • Executes dropped EXE
                        PID:1236
                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4316
                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                        10⤵
                        • Checks computer location settings
                        PID:4168
                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                          11⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1112
                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4424
                        • C:\Users\Admin\AppData\Local\Temp\EU.exe
                          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                          11⤵
                          • Checks computer location settings
                          PID:644
                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                            12⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3504
                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                            12⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1580
                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                            12⤵
                            • Checks computer location settings
                            PID:560
                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                              13⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:4768
                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3360
                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                              13⤵
                              • Checks computer location settings
                              PID:2544
                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                14⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4888
                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                14⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1620
                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                14⤵
                                • Checks computer location settings
                                PID:824
                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3704
                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2248
                                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                  15⤵
                                  • Checks computer location settings
                                  PID:1384
                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:688
                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3684
                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                    16⤵
                                    • Checks computer location settings
                                    PID:3628
                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:4392
                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4548
                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                      17⤵
                                      • Checks computer location settings
                                      PID:644
                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1920
                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:720
                                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                        18⤵
                                        • Checks computer location settings
                                        PID:3604
                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:872
                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3248
                                        • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                          19⤵
                                          • Checks computer location settings
                                          PID:3360
                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:5100
                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2256
                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                            20⤵
                                              PID:4084
                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                21⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:920
                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                21⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2804
                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                21⤵
                                                • Checks computer location settings
                                                PID:4760
                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                  22⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1168
                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                  22⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1136
                                                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                  22⤵
                                                  • Checks computer location settings
                                                  PID:4016
                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                    23⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1548
                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                    23⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:456
                                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                    23⤵
                                                    • Checks computer location settings
                                                    PID:2992
                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                      24⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1580
                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                      24⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4472
                                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                      24⤵
                                                      • Checks computer location settings
                                                      PID:1732
                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                        25⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3228
                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                        25⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1160
                                                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                        25⤵
                                                          PID:4108
                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                            26⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1460
                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                            26⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2560
                                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                            26⤵
                                                            • Checks computer location settings
                                                            PID:1524
                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                              27⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4692
                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                              27⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4868
                                                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                              27⤵
                                                              • Checks computer location settings
                                                              PID:3272
                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                28⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5036
                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                28⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3772
                                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                28⤵
                                                                • Checks computer location settings
                                                                PID:812
                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                  29⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2264
                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                  29⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4216
                                                                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                  29⤵
                                                                  • Checks computer location settings
                                                                  PID:2248
                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                    30⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3512
                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                    30⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:868
                                                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                    30⤵
                                                                    • Checks computer location settings
                                                                    PID:4992
                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                      31⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4168
                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                      31⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4728
                                                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                      31⤵
                                                                      • Checks computer location settings
                                                                      PID:468
                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                        32⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2344
                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                        32⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3232
                                                                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                        32⤵
                                                                        • Checks computer location settings
                                                                        PID:4576
                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                          33⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:520
                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                          33⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4736
                                                                        • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                          33⤵
                                                                          • Checks computer location settings
                                                                          PID:4776
                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                            34⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2108
                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                            34⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2508
                                                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                            34⤵
                                                                            • Checks computer location settings
                                                                            PID:208
                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                              35⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1724
                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                              35⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4920
                                                                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                              35⤵
                                                                              • Checks computer location settings
                                                                              PID:32
                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                36⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4692
                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                36⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4504
                                                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                36⤵
                                                                                • Checks computer location settings
                                                                                PID:4944
                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                  37⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3260
                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                  37⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1824
                                                                                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                  37⤵
                                                                                  • Checks computer location settings
                                                                                  PID:2844
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                    38⤵
                                                                                      PID:4500
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                      38⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:920
                                                                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                      38⤵
                                                                                        PID:816
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                          39⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1168
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                          39⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2776
                                                                                        • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                          39⤵
                                                                                          • Checks computer location settings
                                                                                          PID:3364
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                            40⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1568
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                            40⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2860
                                                                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                            40⤵
                                                                                            • Checks computer location settings
                                                                                            PID:1380
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                              41⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3244
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                              41⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3468
                                                                                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                              41⤵
                                                                                              • Checks computer location settings
                                                                                              PID:1788
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                42⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1132
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                42⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1684
                                                                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                42⤵
                                                                                                • Checks computer location settings
                                                                                                PID:960
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                  43⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3840
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                  43⤵
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:560
                                                                                                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                  43⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:3088
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                    44⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:864
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                    44⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2212
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                    44⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:1460
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                      45⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3700
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                      45⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3636
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                      45⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:2388
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                        46⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3128
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                        46⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2116
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                        46⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:4488
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                          47⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2348
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                          47⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:1864
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                          47⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:3148
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                            48⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1996
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                            48⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3068
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                            48⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:2764
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                              49⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4200
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                              49⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2312
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                              49⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:2704
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                50⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4064
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                50⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2260
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                50⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:4540
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                  51⤵
                                                                                                                    PID:316
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                    51⤵
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4880
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                    51⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:4524
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                      52⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1580
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                      52⤵
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2504
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                      52⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:3504
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                        53⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3708
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                        53⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2204
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                        53⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:232
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                          54⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:640
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                          54⤵
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3108
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                          54⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:3248
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                            55⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2560
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                            55⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4332
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                            55⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:776
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                              56⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4868
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                              56⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2272
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                              56⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:3264
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                57⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3128
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                57⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1620
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                57⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:4464
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                  58⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2348
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                  58⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1300
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                  58⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:3260
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                    59⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:868
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                    59⤵
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:1316
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                    59⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    PID:2156
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                      60⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3308
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                      60⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2704
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                      60⤵
                                                                                                                                        PID:4948
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                          61⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4540
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                          61⤵
                                                                                                                                            PID:3448
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                            61⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:1588
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                              62⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3744
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                              62⤵
                                                                                                                                                PID:3928
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                                62⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:3468
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                                  63⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3652
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                                  63⤵
                                                                                                                                                    PID:2204
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                                    63⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:4776
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                                      64⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1492
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                                      64⤵
                                                                                                                                                        PID:4368
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                                        64⤵
                                                                                                                                                          PID:560
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                                            65⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1472
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                                            65⤵
                                                                                                                                                              PID:2900
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\EU.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\EU.exe"
                                                                                                                                                              65⤵
                                                                                                                                                                PID:1460

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EU.exe.log
                                Filesize

                                654B

                                MD5

                                2ff39f6c7249774be85fd60a8f9a245e

                                SHA1

                                684ff36b31aedc1e587c8496c02722c6698c1c4e

                                SHA256

                                e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                SHA512

                                1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Load.exe.log
                                Filesize

                                1KB

                                MD5

                                baf55b95da4a601229647f25dad12878

                                SHA1

                                abc16954ebfd213733c4493fc1910164d825cac8

                                SHA256

                                ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                SHA512

                                24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Done.exe.log
                                Filesize

                                410B

                                MD5

                                3bbb825ef1319deb378787046587112b

                                SHA1

                                67da95f0031be525b4cf10645632ca34d66b913b

                                SHA256

                                d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0

                                SHA512

                                7771ae543e188d544e1bb6c65e0453a6777c1c39790a355f4cce652a815bfaf94dd426de3db910a67bd06e463ac0143d9e2ca44d2b12af7f0d84c27b4a09cc54

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                Filesize

                                69KB

                                MD5

                                2453fa8ef7ccc79cada8679f06f2be53

                                SHA1

                                b3db41bc85d300a069e6636b5c9e7dcf0a6a95b2

                                SHA256

                                e0e329ca03adcd56c5ff4a5cbdaff475a1cf636dfce64b7da1a05f5c74daac88

                                SHA512

                                a28398843232745153b3f57d2166aca95e9f930a8334c0ffdb2db192fc8cc8b2d5f5a0a0d123a996f2aa738668209a3541ffb9ed6f42f665aefb9300cd3d45d4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                Filesize

                                74KB

                                MD5

                                4fc5086bcb8939429aea99f7322e619b

                                SHA1

                                8d3bd7d005710a8ae0bd0143d18b437be20018d7

                                SHA256

                                e31d6dc4d6f89573321f389c5b3f12838545ff8d2f1380cfba1782d39853e9fd

                                SHA512

                                04e230f5b39356aecf4732ac9a2f4fea96e51018907e2f22c7e3f22e51188b64cdb3e202fe324f5e3500761fae43f898bf9489aa8faa34eff3566e1119a786d2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ak3lcl2.en1.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmp9EA1.tmp.bat
                                Filesize

                                148B

                                MD5

                                3addf17981a89ebdab7d4ea7118d6992

                                SHA1

                                8b6522000dfb6f1de6e18ce3aa30b8c4ecb02b74

                                SHA256

                                59e0d9d902bc26ed8e4ea83c8ebe1e5da1135890b4b45dcc4b52583a7eae28db

                                SHA512

                                a6133c07b2bdb480703b7b1e5198384b1b50ce6f802cc39494a33f972458fac92e5284d08ae981fbd21d70393c802212c6b108490005fb0dd31e3f158cd1e4d1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpA950.tmp.bat
                                Filesize

                                148B

                                MD5

                                c65356ea328652fa24525fa9d9c7b6b8

                                SHA1

                                756b4b99de1115c28184a3c82f4a5988b366fc07

                                SHA256

                                11d477b300d5626d2b4486d5a12f60858e4aca0ec9a6b5a49d7ebee38ad4ad47

                                SHA512

                                1a5da6353b22563dcfbccae6825b6664eab4090c663298f783c916f2150b73fbf27f6878150db3839b1682918959bfac040e87bb8d1d6725663d3fb871d79246

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpAFF7.tmp.bat
                                Filesize

                                148B

                                MD5

                                489c9942ea28127d9de853ec2b2cecdd

                                SHA1

                                cec2f2f6bc9bb535c96f2800bf68d96c6ffb6662

                                SHA256

                                6068a0c738df3a25ad0496e1f77ed1c665ebc341e5b5ea7ca8ff0565611bd967

                                SHA512

                                3438dc7c81f2bed9102451dc4078a7942dafd38b736e891f0932f2542fbd8c98e49cb1f0e40f85d575a7adc65c0974cb0c1900d50460fe1bf14ab0876b3dcf79

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                Filesize

                                8B

                                MD5

                                cf759e4c5f14fe3eec41b87ed756cea8

                                SHA1

                                c27c796bb3c2fac929359563676f4ba1ffada1f5

                                SHA256

                                c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                                SHA512

                                c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                                Download Submit

                              • memory/552-78-0x0000000005C20000-0x0000000005C2A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/2572-32-0x0000000000420000-0x0000000000438000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/2572-33-0x0000000005380000-0x0000000005924000-memory.dmp

                                Filesize

                                5.6MB

                                Download

                              • memory/2572-35-0x0000000004CE0000-0x0000000004D72000-memory.dmp

                                Filesize

                                584KB

                                Download

                              • memory/3120-69-0x0000000005760000-0x0000000005AB4000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/3120-99-0x0000000007040000-0x000000000704A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/3120-41-0x00000000023A0000-0x00000000023D6000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/3120-45-0x0000000004E50000-0x0000000005478000-memory.dmp

                                Filesize

                                6.2MB

                                Download

                              • memory/3120-53-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/3120-54-0x0000000004D70000-0x0000000004DD6000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/3120-55-0x0000000004DE0000-0x0000000004E46000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/3120-106-0x00000000072F0000-0x00000000072F8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/3120-105-0x0000000007310000-0x000000000732A000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/3120-104-0x0000000007210000-0x0000000007224000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/3120-75-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/3120-74-0x0000000005C80000-0x0000000005C9E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/3120-103-0x0000000007200000-0x000000000720E000-memory.dmp

                                Filesize

                                56KB

                                Download

                              • memory/3120-102-0x00000000071D0000-0x00000000071E1000-memory.dmp

                                Filesize

                                68KB

                                Download

                              • memory/3120-101-0x0000000007250000-0x00000000072E6000-memory.dmp

                                Filesize

                                600KB

                                Download

                              • memory/3120-82-0x0000000072410000-0x000000007245C000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/3120-92-0x0000000006C70000-0x0000000006C8E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/3120-97-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/3120-93-0x0000000006EA0000-0x0000000006F43000-memory.dmp

                                Filesize

                                652KB

                                Download

                              • memory/3120-81-0x0000000006280000-0x00000000062B2000-memory.dmp

                                Filesize

                                200KB

                                Download

                              • memory/3120-96-0x0000000007620000-0x0000000007C9A000-memory.dmp

                                Filesize

                                6.5MB

                                Download

                              • memory/4072-25-0x0000000000CC0000-0x0000000000CD8000-memory.dmp

                                Filesize

                                96KB

                                Download

                              • memory/4072-28-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4072-30-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4072-76-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4084-31-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4084-0-0x00007FFEAA393000-0x00007FFEAA395000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/4084-3-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4084-1-0x00000000002D0000-0x00000000004F0000-memory.dmp

                                Filesize

                                2.1MB

                                Download

                              • memory/4500-38-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4500-34-0x00007FFEAA390000-0x00007FFEAAE51000-memory.dmp

                                Filesize

                                10.8MB

                                Download