Overview

overview

10

Static

static

10

ddf12a9144...78.exe

windows7-x64

10

ddf12a9144...78.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-01-2025 06:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe

  • Size

    218KB

  • MD5

    f1f1d0ad99a6e3e4d66b45cf74aa64b9

  • SHA1

    b4b7752d04880c9d176ab25339c6b4ccd5a5cf09

  • SHA256

    ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778

  • SHA512

    6f50c1ab8a992e4859e917abf00c29a9fa2f118a59ed8d654c198ea7e7ac0163f3c908dc7963e48d914f566820413a2e9a258092bfa05b15af8f5df5e6edc458

  • SSDEEP

    6144:k90ICFBj7tf/k+AbAyUeRUqttyH7xOc6H5c6HcT66vlmrL:ZBj7hybABevai

Score
10/10
neshtadiscoverypersistencespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 64 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe
    "C:\Users\Admin\AppData\Local\Temp\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\svchost.exe
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe
          "C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3672
            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:3456
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3696
                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1396
                  • C:\Windows\svchost.com
                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4064
                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                      10⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4056
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2756
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:2480
                          • C:\Windows\svchost.com
                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2952
                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:2544
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3756
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                  16⤵
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:4896
                                  • C:\Windows\svchost.com
                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4976
                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:1524
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1720
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4476
                                          • C:\Windows\svchost.com
                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3728
                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • Suspicious use of WriteProcessMemory
                                              PID:3140
                                              • C:\Windows\svchost.com
                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                23⤵
                                                • Executes dropped EXE
                                                PID:1092
                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:3276
                                                  • C:\Windows\svchost.com
                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    PID:5072
                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                      26⤵
                                                      • Executes dropped EXE
                                                      PID:1188
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        PID:3380
                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          PID:4312
                                                          • C:\Windows\svchost.com
                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            PID:532
                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              PID:4688
                                                              • C:\Windows\svchost.com
                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                PID:1296
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  PID:3340
                                                                  • C:\Windows\svchost.com
                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    PID:3884
                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • Modifies registry class
                                                                      PID:2120
                                                                      • C:\Windows\svchost.com
                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        PID:2416
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3048
                                                                          • C:\Windows\svchost.com
                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            PID:840
                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              PID:4140
                                                                              • C:\Windows\svchost.com
                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                PID:1552
                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  PID:1824
                                                                                  • C:\Windows\svchost.com
                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1724
                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Modifies registry class
                                                                                      PID:3120
                                                                                      • C:\Windows\svchost.com
                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1784
                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          PID:2568
                                                                                          • C:\Windows\svchost.com
                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4972
                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              PID:4864
                                                                                              • C:\Windows\svchost.com
                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1012
                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  PID:3636
                                                                                                  • C:\Windows\svchost.com
                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1676
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in Windows directory
                                                                                                      PID:684
                                                                                                      • C:\Windows\svchost.com
                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:968
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                          52⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          PID:4940
                                                                                                          • C:\Windows\svchost.com
                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:4260
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Modifies registry class
                                                                                                              PID:740
                                                                                                              • C:\Windows\svchost.com
                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:2356
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Modifies registry class
                                                                                                                  PID:768
                                                                                                                  • C:\Windows\svchost.com
                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:536
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Modifies registry class
                                                                                                                      PID:696
                                                                                                                      • C:\Windows\svchost.com
                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3496
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4228
                                                                                                                          • C:\Windows\svchost.com
                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:724
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                              62⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4772
                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3056
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3700
                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                    65⤵
                                                                                                                                      PID:4892
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                        66⤵
                                                                                                                                          PID:3456
                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                            67⤵
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:440
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:456
                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                69⤵
                                                                                                                                                  PID:4332
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                    70⤵
                                                                                                                                                      PID:1992
                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                        71⤵
                                                                                                                                                          PID:1868
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                            72⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            PID:2180
                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                              73⤵
                                                                                                                                                                PID:1968
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                  74⤵
                                                                                                                                                                    PID:4624
                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                      75⤵
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:3840
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                        76⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:2944
                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                          77⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4028
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                            78⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            PID:3992
                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                              79⤵
                                                                                                                                                                                PID:3576
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                  80⤵
                                                                                                                                                                                    PID:1388
                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                      81⤵
                                                                                                                                                                                        PID:464
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                          82⤵
                                                                                                                                                                                            PID:884
                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                              83⤵
                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                        PID:1196
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4380
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                        PID:3728
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                              PID:2228
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:876
                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                            PID:1740
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:1704
                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                  PID:720
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2460
                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:2796
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                            PID:3276
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                        PID:3364
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                            PID:544
                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:1656
                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                      PID:2704
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                        PID:1872
                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                  PID:4016
                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3944
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                      PID:2756
                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                    PID:3040
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                        PID:3680
                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                    PID:1376
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                        PID:624
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:512
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              PID:5068
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2632
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1720
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                                          PID:936
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                            PID:3420
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4496
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1384
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                    PID:116
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1456
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1292
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1736
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:436
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:336
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\DDF12A~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:780
                                                                                                                                                                                                                            • C:\Windows\svchost.exe
                                                                                                                                                                                                                              C:\Windows\svchost.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                              PID:1908
                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3636
                                                                                                                                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:876
                                                                                                                                                                                                                                • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3420

                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    328KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    39c8a4c2c3984b64b701b85cb724533b

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    147KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    3b35b268659965ab93b6ee42f8193395

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    8faefc346e99c9b2488f2414234c9e4740b96d88

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    125KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    cce8964848413b49f18a44da9cb0a79b

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    0b7452100d400acebb1c1887542f322a92cbd7ae

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    d47ed8961782d9e27f359447fa86c266

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    d37d3f962c8d302b18ec468b4abe94f792f72a3b

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    325KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    892cf4fc5398e07bf652c50ef2aa3b88

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    c399e55756b23938057a0ecae597bd9dbe481866

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    325KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    9a8d683f9f884ddd9160a5912ca06995

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    98dc8682a0c44727ee039298665f5d95b057c854

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    505KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    452c3ce70edba3c6e358fad9fb47eb4c

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    d24ea3b642f385a666159ef4c39714bec2b08636

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    146KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    cdc455fa95578320bd27e0d89a7c9108

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    60cde78a74e4943f349f1999be3b6fc3c19ab268

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    d7f214dc55857c3576675279261a0ee1881f7ddee4755bb0b9e7566fc0f425a9

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    35f3741538bd59f6c744bcad6f348f4eb6ea1ee542f9780daa29de5dbb2d772b01fe4774fb1c2c7199a349488be309ceedd562ceb5f1bdcdd563036b301dcd9f

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    146KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    d9a290f7aec8aff3591c189b3cf8610a

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    7558d29fb32018897c25e0ac1c86084116f1956c

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    41bed95cb1101181a97460e2395efebb0594849e6f48b80a2b7c376ddf5ce0ea

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    b55ab687a75c11ba99c64be42ad8471576aa2df10ce1bb61e902e98827e3a38cd922e365751bd485cac089c2bd8bccf939a578da7238506b77fe02a3eb7994c6

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    198KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    7429ce42ac211cd3aa986faad186cedd

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    b61a57f0f99cfd702be0fbafcb77e9f911223fac

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    d608c05409ac4bd05d8e0702fcf66dfae5f4f38cbae13406842fa5504f4d616f

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    ee4456877d6d881d9904013aabecb9f2daf6fc0ec7a7c9251e77396b66a7f5a577fe8544e64e2bb7464db429db56a3fe47c183a81d40cc869d01be573ab5e4c1

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    433KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    674eddc440664b8b854bc397e67ee338

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    af9d74243ee3ea5f88638172f592ed89bbbd7e0d

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    20bbf92426732ff7269b4f2f89d404d5fee0fa6a20944004d2eeb3cc2d1fa457

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    5aced0e2235f113e323d6b28be74da5e4da4dc881629461df4644a52bccd717dc6d2632c40ed8190b3ad060b8b62c347757a0bbe82680d892114c1f0529146b7

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    509KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    7c73e01bd682dc67ef2fbb679be99866

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    ad3834bd9f95f8bf64eb5be0a610427940407117

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    b2f3398e486cde482cb6bea18f4e5312fa2db7382ca25cea17bcba5ab1ff0e891d59328bc567641a9da05caca4d7c61dc102289d46e7135f947ce6155e295711

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    138KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    5e08d87c074f0f8e3a8e8c76c5bf92ee

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    f52a554a5029fb4749842b2213d4196c95d48561

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    5d548c2cc25d542f2061ed9c8e38bd5ca72bddb37dd17654346cae8a19645714

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    dd98d6fa7d943604914b2e3b27e1f21a95f1fe1feb942dd6956e864da658f4fbd9d1d0cf775e79ceaae6a025aafd4e633763389c37034134bd5245969bec383e

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    41b1e87b538616c6020369134cbce857

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    a255c7fef7ba2fc1a7c45d992270d5af023c5f67

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    08465cc139ee50a7497f8c842f74730d3a8f1a73c0b7caca95e9e6d37d3beed3

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    3a354d3577b45f6736203d5a35a2d1d543da2d1e268cefeffe6bdb723ff63c720ceb2838701144f5fec611470d77649846e0fb4770d6439f321f6b819f03e4db

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    301d7f5daa3b48c83df5f6b35de99982

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    17e68d91f3ec1eabde1451351cc690a1978d2cd4

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    abe398284d90be5e5e78f98654b88664e2e14478f7eb3f55c5fd1c1bcf1bebee

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    4a72a24dec461d116fe8324c651913273ccaa50cb036ccdacb3ae300e417cf4a64aa458869b8d2f3b4c298c59977437d11b241d08b391a481c3226954bba22e4

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    11486d1d22eaacf01580e3e650f1da3f

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    a47a721efec08ade8456a6918c3de413a2f8c7a2

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    5e1b1daa9968ca19a58714617b7e691b6b6f34bfacaf0dcf4792c48888b1a5d3

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    5bd54e1c1308e04a769e089ab37bd9236ab97343b486b85a018f2c8ad060503c97e8bc51f911a63f9b96dd734eb7d21e0a5c447951246d972b05fafeef4633da

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    3.2MB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    5119e350591269f44f732b470024bb7c

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    4ccd48e4c6ba6e162d1520760ee3063e93e2c014

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    142KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    773fbe09d9747591794e363cec414b5e

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    db32c2f420887bedf2df329f4fe263dc08444895

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    dd0b9d792dd8267582dd7fea67a154ec785f1f178c896b877db553882c8db5ff

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    07e86b6c77016a486312a9eccb25318f0fce6ed9ee9514464d4373aa55d9d1190fae4b6f8af89ee862652d2405bba773d1f90065e5dcf0ebe9659f805f6f9a5f

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    177KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    705359cffed8f2d111ee35d4bffceca8

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    d62777bcf346e8014218e46e322a2c5d5040bb1f

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    fc579f06eb04d3911bfd73b4d61d77b48325727f394b09094d196f3f21a39072

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    60f3f18221a908020f5a4a20b26dd60b739f78f6c3c43c39cbbf856e1f5aaa936c799fd25e444c2683bca19d00c10a650894ea38a836b432ad6daad5e3213f60

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\ddf12a9144022ef98276c6723c0a8d2cf1f1f4820048cf96d9a0275e7cf37778.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    142KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    aefe92d83bf98f9c9f6e72e43fbb84f3

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    5f81768e3242fd0bf896941b42c34d04bccb15bf

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    8bc808c28f97279493a704a38c2526cdef71e68eaec88df940198f19a3b1ea0e

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    5df867a3479432e49d304839478de0e91924986a30bace90f0f7f1b12112896653b7c89343c640c283ccf605e1421b175925d2a2ea0bfce225d2fffc938c73ff

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\Windows\directx.sys
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    57B

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    552bf0dc2d391ce02aec3f2e06e91ff7

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    3287d7450f60696b5ea6f8d7dd8a8b8a0ba71fa1

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    e9705c8b0060a55b5360f930bde45fd545c2af42863cfadb4893f1669ad02c9a

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    166d7bb11ea0adf705b98010c7682bef9aa4928e3808ff9d662cde1625a49c556d060245e5dc81266ea2a963ff4f682da1544159c0bbaa825cccf408a031c1a9

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    36fd5e09c417c767a952b4609d73a54b

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    299399c5a2403080a5bf67fb46faec210025b36d

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • C:\Windows\svchost.exe
                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    35KB

                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                    9e3c13b6556d5636b745d3e466d47467

                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                    2ac1c19e268c49bc508f83fe3d20f495deb3e538

                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                    20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                    5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                  • memory/532-277-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/536-389-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/684-359-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/696-391-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/724-405-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/740-380-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/768-383-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/840-309-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/968-365-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1012-349-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1092-241-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1188-256-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1296-285-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1396-53-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1524-134-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1552-317-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1676-357-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1720-154-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1724-325-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1784-333-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/1824-324-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2120-295-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2356-381-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2416-301-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2480-70-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2544-82-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2568-335-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2756-66-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/2952-78-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3048-303-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3056-413-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3120-327-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3140-193-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3276-248-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3340-292-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3380-262-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3380-20-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    52KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3456-41-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3456-423-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3496-397-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3636-351-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3672-30-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3696-42-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3700-415-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3728-180-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3756-96-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3884-293-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/3920-11-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    56KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4056-58-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4064-54-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4140-316-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4228-399-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4260-373-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4312-271-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4476-173-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4688-279-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4772-407-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4864-343-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4892-421-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4896-114-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4940-372-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4972-341-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/4976-123-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                  • memory/5072-254-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                    Download