Overview

overview

10

Static

static

3

Loader.exe

windows7-x64

10

Loader.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Loader.exe

  • Size

    2.1MB

  • MD5

    084519881ac16c16cf9206f97a68f79e

  • SHA1

    7b0fbc312ec9176a69ccb3036636e2423320cd79

  • SHA256

    89057bbeb5618835524cf8fc3a645fc5137553638520e763901fa1f2f8cdbe66

  • SHA512

    84b2867560cdbd3ca797196b208495631e49a87a2ea7451d6d68b52ea1ada0546c81d9b2e37b630440565cd53661c6541eb91c8bd662bb10780f87a7c7db5633

  • SSDEEP

    49152:4ZZosvRgdkadC7i03aQAZutzArxizJZTrEbupmpVwMgc:4ZZostak7RGuqGJZXdpmIn

Score
10/10
asyncratvenomratdefaultdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

193.161.193.99:53757

Mutex

hsaurcrgqwhjimnkbht

Attributes
  • delay

    1

  • install

    true

  • install_file

    Load.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • VenomRAT 2 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Async RAT payload 1 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Users\Admin\AppData\Local\Temp\Done.exe
      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ACCApi'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3292
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe" /st 19:32 /du 23:59 /sc daily /ri 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3808
      • C:\Users\Admin\AppData\Local\ACCApi\apihost.exe
        "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2896
    • C:\Users\Admin\AppData\Local\Temp\Load.exe
      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB892.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2944
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:4984
    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Users\Admin\AppData\Local\Temp\Done.exe
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:1808
      • C:\Users\Admin\AppData\Local\Temp\Load.exe
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4920
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC4F6.tmp.bat""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1576
          • C:\Windows\system32\timeout.exe
            timeout 3
            5⤵
            • Delays execution with timeout.exe
            PID:1636
          • C:\Users\Admin\AppData\Roaming\Load.exe
            "C:\Users\Admin\AppData\Roaming\Load.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4804
      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Users\Admin\AppData\Local\Temp\Done.exe
          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1260
        • C:\Users\Admin\AppData\Local\Temp\Load.exe
          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1108
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4292
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCB7E.tmp.bat""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4132
            • C:\Windows\system32\timeout.exe
              timeout 3
              6⤵
              • Delays execution with timeout.exe
              PID:3600
            • C:\Users\Admin\AppData\Roaming\Load.exe
              "C:\Users\Admin\AppData\Roaming\Load.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4528
        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Users\Admin\AppData\Local\Temp\Done.exe
            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1188
          • C:\Users\Admin\AppData\Local\Temp\Load.exe
            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2236
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
              6⤵
                PID:1552
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:232
            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
              5⤵
              • Checks computer location settings
              PID:4604
              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2156
              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1668
              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                6⤵
                • Checks computer location settings
                PID:2080
                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3912
                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1604
                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                  7⤵
                  • Checks computer location settings
                  PID:4364
                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1628
                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3352
                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                    8⤵
                    • Checks computer location settings
                    PID:2896
                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                      9⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4388
                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1488
                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                      9⤵
                      • Checks computer location settings
                      PID:1052
                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:516
                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1512
                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                        10⤵
                        • Checks computer location settings
                        PID:2308
                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                          11⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:5088
                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1108
                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                          11⤵
                          • Checks computer location settings
                          PID:2828
                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                            12⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3412
                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                            12⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3320
                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                            12⤵
                            • Checks computer location settings
                            PID:1984
                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                              13⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2460
                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4224
                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                              13⤵
                              • Checks computer location settings
                              PID:1884
                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                14⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:456
                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                14⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2192
                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                14⤵
                                • Checks computer location settings
                                PID:2980
                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:2604
                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3664
                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                  15⤵
                                  • Checks computer location settings
                                  PID:2188
                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:3620
                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:956
                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                    16⤵
                                    • Checks computer location settings
                                    PID:4712
                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      PID:1348
                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1688
                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                      17⤵
                                      • Checks computer location settings
                                      PID:2968
                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3356
                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4296
                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                        18⤵
                                        • Checks computer location settings
                                        PID:4032
                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          PID:4472
                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4732
                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                          19⤵
                                          • Checks computer location settings
                                          PID:1260
                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1636
                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4404
                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                            20⤵
                                            • Checks computer location settings
                                            PID:3936
                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:880
                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1240
                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                              21⤵
                                              • Checks computer location settings
                                              PID:3496
                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:876
                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4936
                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                22⤵
                                                • Checks computer location settings
                                                PID:2084
                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2080
                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4324
                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                  23⤵
                                                  • Checks computer location settings
                                                  PID:4132
                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1140
                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:8
                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                    24⤵
                                                    • Checks computer location settings
                                                    PID:3944
                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1608
                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2188
                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      PID:2812
                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3728
                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4384
                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        PID:1948
                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3840
                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4392
                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                          27⤵
                                                          • Checks computer location settings
                                                          PID:2252
                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4956
                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3000
                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                            28⤵
                                                            • Checks computer location settings
                                                            PID:2260
                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:516
                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4716
                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                              29⤵
                                                              • Checks computer location settings
                                                              PID:1036
                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2000
                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2244
                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                30⤵
                                                                • Checks computer location settings
                                                                PID:1324
                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4360
                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3412
                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  PID:880
                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1664
                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                    32⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4936
                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    PID:1256
                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                      33⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4796
                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                      33⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5028
                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                      33⤵
                                                                      • Checks computer location settings
                                                                      PID:2192
                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                        34⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4132
                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                        34⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1976
                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                        34⤵
                                                                        • Checks computer location settings
                                                                        PID:64
                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                          35⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3664
                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                          35⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4216
                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          PID:1040
                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                            36⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4772
                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                            36⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:208
                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                            36⤵
                                                                            • Checks computer location settings
                                                                            PID:1500
                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                              37⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2920
                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                              37⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2632
                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                              37⤵
                                                                              • Checks computer location settings
                                                                              PID:4452
                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                38⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:116
                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                38⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4092
                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                38⤵
                                                                                • Checks computer location settings
                                                                                PID:1568
                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                  39⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3436
                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                  39⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1512
                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                  39⤵
                                                                                  • Checks computer location settings
                                                                                  PID:2808
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                    40⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4472
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                    40⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4552
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                    40⤵
                                                                                    • Checks computer location settings
                                                                                    PID:5008
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                      41⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1812
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                      41⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:216
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                      41⤵
                                                                                      • Checks computer location settings
                                                                                      PID:3936
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                        42⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:800
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                        42⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1668
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                        42⤵
                                                                                        • Checks computer location settings
                                                                                        PID:1820
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                          43⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:512
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                          43⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:880
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                          43⤵
                                                                                          • Checks computer location settings
                                                                                          PID:4584
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                            44⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1544
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                            44⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1728
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                            44⤵
                                                                                            • Checks computer location settings
                                                                                            PID:4064
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                              45⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3384
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                              45⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:464
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                              45⤵
                                                                                              • Checks computer location settings
                                                                                              PID:348
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                46⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:628
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                46⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4436
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                46⤵
                                                                                                • Checks computer location settings
                                                                                                PID:3604
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                  47⤵
                                                                                                    PID:3952
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                    47⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4348
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                    47⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:1368
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                      48⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2896
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                      48⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1900
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                      48⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:4984
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                        49⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4220
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                        49⤵
                                                                                                          PID:4884
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                          49⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:4272
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                            50⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1180
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                            50⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4744
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                            50⤵
                                                                                                              PID:116
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                51⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1512
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                51⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4388
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                51⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:2108
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                  52⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3048
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                  52⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3844
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                  52⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:4472
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                    53⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1576
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                    53⤵
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2828
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                    53⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:1248
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                      54⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4416
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                      54⤵
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4236
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                      54⤵
                                                                                                                        PID:3412
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                          55⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:880
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                          55⤵
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2384
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                          55⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:4496
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                            56⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4656
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                            56⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:760
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                            56⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:1960
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                              57⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1196
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                              57⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1604
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                              57⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:348
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                58⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2612
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                58⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:2228
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                58⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:3628
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                  59⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2812
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                  59⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3416
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                  59⤵
                                                                                                                                    PID:1628
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                      60⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3556
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                      60⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:556
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                      60⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:1948
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                        61⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4300
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                        61⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:2352
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                        61⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:4700
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                          62⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2212
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                          62⤵
                                                                                                                                            PID:4856
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                            62⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:4840
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                              63⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4852
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                              63⤵
                                                                                                                                                PID:2108
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                63⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:1740
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                                  64⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2308
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                                  64⤵
                                                                                                                                                    PID:4472
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                    64⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:2576
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                                                                                                                      65⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4312
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                                                                                                                      65⤵
                                                                                                                                                        PID:3872
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                                                                                                                        65⤵
                                                                                                                                                          PID:1772

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Load.exe.log
                          Filesize

                          1KB

                          MD5

                          baf55b95da4a601229647f25dad12878

                          SHA1

                          abc16954ebfd213733c4493fc1910164d825cac8

                          SHA256

                          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                          SHA512

                          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log
                          Filesize

                          654B

                          MD5

                          2ff39f6c7249774be85fd60a8f9a245e

                          SHA1

                          684ff36b31aedc1e587c8496c02722c6698c1c4e

                          SHA256

                          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                          SHA512

                          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Done.exe.log
                          Filesize

                          410B

                          MD5

                          3bbb825ef1319deb378787046587112b

                          SHA1

                          67da95f0031be525b4cf10645632ca34d66b913b

                          SHA256

                          d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0

                          SHA512

                          7771ae543e188d544e1bb6c65e0453a6777c1c39790a355f4cce652a815bfaf94dd426de3db910a67bd06e463ac0143d9e2ca44d2b12af7f0d84c27b4a09cc54

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                          Filesize

                          69KB

                          MD5

                          2453fa8ef7ccc79cada8679f06f2be53

                          SHA1

                          b3db41bc85d300a069e6636b5c9e7dcf0a6a95b2

                          SHA256

                          e0e329ca03adcd56c5ff4a5cbdaff475a1cf636dfce64b7da1a05f5c74daac88

                          SHA512

                          a28398843232745153b3f57d2166aca95e9f930a8334c0ffdb2db192fc8cc8b2d5f5a0a0d123a996f2aa738668209a3541ffb9ed6f42f665aefb9300cd3d45d4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                          Filesize

                          74KB

                          MD5

                          4fc5086bcb8939429aea99f7322e619b

                          SHA1

                          8d3bd7d005710a8ae0bd0143d18b437be20018d7

                          SHA256

                          e31d6dc4d6f89573321f389c5b3f12838545ff8d2f1380cfba1782d39853e9fd

                          SHA512

                          04e230f5b39356aecf4732ac9a2f4fea96e51018907e2f22c7e3f22e51188b64cdb3e202fe324f5e3500761fae43f898bf9489aa8faa34eff3566e1119a786d2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzj3qjat.kum.ps1
                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpB892.tmp.bat
                          Filesize

                          148B

                          MD5

                          f2e004164b191a2d3fd66774f29c52f1

                          SHA1

                          1adfdd0bc91087eaad7e575dd73f113d4957eb42

                          SHA256

                          ad027d5a5c7ac4311fe4edcd47e6de1bd322f29feb469c0fd1c28975af35347d

                          SHA512

                          9553e9802fe044f04570a19500afdb230bf0608e6d946d2052959a4ab23b144bc73cadffddadba67afe985a62b6af7bd707edacd52798bb412dbd7612122d4b6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpC4F6.tmp.bat
                          Filesize

                          148B

                          MD5

                          edae2f3d08dede51e949ee487a764795

                          SHA1

                          2a0036ba44ea64d8156d9cab0e175f4143801bd4

                          SHA256

                          8c78e1be6b610109df108bbe862331ff010f026ffb99353af2a568b0fdd8c99b

                          SHA512

                          9a2361dc430fa0c031a33ae6e03e31d1f9ff7bc131dfe67101ba092c7facc90c5a43c9d7c0a6f0d89abed379579741a48f00033aba6dde111ba0f4627729c85d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpCB7E.tmp.bat
                          Filesize

                          148B

                          MD5

                          d8eb85e26355ebbb738e6676d2383f10

                          SHA1

                          eb8abf6911001c96fc2a0056f79f471ec25e42a2

                          SHA256

                          f82813447f5c7280034bba8b9bc993d48481e87628626daddaaf64aad74a2e0d

                          SHA512

                          878093aaab59e2900e930bce323b1f425b406c97bb3b40ef12fd5e09a452d1e2420cb3a7c109a32d27ebb16d1d30430aec01f4873681568a52f789f0ab66091a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                          Filesize

                          8B

                          MD5

                          cf759e4c5f14fe3eec41b87ed756cea8

                          SHA1

                          c27c796bb3c2fac929359563676f4ba1ffada1f5

                          SHA256

                          c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                          SHA512

                          c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                          Download Submit

                        • memory/1300-32-0x0000000000DA0000-0x0000000000DB8000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/1300-33-0x0000000005C30000-0x00000000061D4000-memory.dmp

                          Filesize

                          5.6MB

                          Download

                        • memory/1300-35-0x0000000005680000-0x0000000005712000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/1808-78-0x0000000005F70000-0x0000000005F7A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/3292-96-0x0000000007200000-0x00000000072A3000-memory.dmp

                          Filesize

                          652KB

                          Download

                        • memory/3292-99-0x00000000073B0000-0x00000000073BA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/3292-109-0x0000000007660000-0x0000000007668000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/3292-108-0x0000000007680000-0x000000000769A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/3292-47-0x0000000004A40000-0x0000000004A76000-memory.dmp

                          Filesize

                          216KB

                          Download

                        • memory/3292-51-0x00000000050E0000-0x0000000005708000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/3292-59-0x0000000005050000-0x0000000005072000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/3292-104-0x0000000007580000-0x0000000007594000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/3292-61-0x00000000058F0000-0x0000000005956000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3292-60-0x0000000005880000-0x00000000058E6000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/3292-75-0x0000000005AE0000-0x0000000005E34000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/3292-77-0x0000000006030000-0x000000000607C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/3292-76-0x0000000006000000-0x000000000601E000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/3292-103-0x0000000007570000-0x000000000757E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/3292-101-0x0000000007540000-0x0000000007551000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/3292-100-0x00000000075C0000-0x0000000007656000-memory.dmp

                          Filesize

                          600KB

                          Download

                        • memory/3292-83-0x0000000006FB0000-0x0000000006FE2000-memory.dmp

                          Filesize

                          200KB

                          Download

                        • memory/3292-94-0x00000000065E0000-0x00000000065FE000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/3292-84-0x0000000072B00000-0x0000000072B4C000-memory.dmp

                          Filesize

                          304KB

                          Download

                        • memory/3292-98-0x0000000007340000-0x000000000735A000-memory.dmp

                          Filesize

                          104KB

                          Download

                        • memory/3292-97-0x0000000007980000-0x0000000007FFA000-memory.dmp

                          Filesize

                          6.5MB

                          Download

                        • memory/4312-25-0x0000000000E00000-0x0000000000E18000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/4312-29-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4312-31-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4312-44-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4340-39-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4340-34-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4844-0-0x00007FF929F63000-0x00007FF929F65000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/4844-30-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4844-18-0x00007FF929F60000-0x00007FF92AA21000-memory.dmp

                          Filesize

                          10.8MB

                          Download

                        • memory/4844-1-0x0000000000900000-0x0000000000B24000-memory.dmp

                          Filesize

                          2.1MB

                          Download