00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974

Analysis

max time kernel
298s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/03/2025, 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Size

1.1MB
MD5

da2dd76b31a45ea2b9f54e9a7ff22f79
SHA1

d674ed49f4be14b16abe7b71b96927288740309e
SHA256

00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974
SHA512

c5f25453068d7bff4af855873b59b95db69dc456d9a38c5cddba07eb95c9a2a58d98bb391d823cc9b41c8aaae15234a2baac642202c44a96c41c7683ede89178
SSDEEP

24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aLF/IcUuJ94fdFc:oTvC/MTQYxsWR7aLFRUuiF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2420	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1268	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1580	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2448	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2492	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1324	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2012	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1608	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1576	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
600	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2148	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1008	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2344	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1956	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2756	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2944	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2604	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2160	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1240	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2144	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2004	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2816	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1312	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2000	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1072	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2488	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1264	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
540	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2292	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2528	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
920	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
948	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1848	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1692	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1592	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2896	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2768	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2620	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2800	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2564	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
856	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1240	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2520	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2424	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2964	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2788	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2568	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2252	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2480	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
2440	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
3016	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
540	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1764	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1576	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
1892	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2860	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	30
PID 2468 wrote to memory of 2860	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	30
PID 2468 wrote to memory of 2860	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	30
PID 2468 wrote to memory of 2860	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	30
PID 2468 wrote to memory of 2876	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	31
PID 2468 wrote to memory of 2876	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	31
PID 2468 wrote to memory of 2876	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	31
PID 2468 wrote to memory of 2876	2468	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	31
PID 2876 wrote to memory of 2196	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	32
PID 2876 wrote to memory of 2196	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	32
PID 2876 wrote to memory of 2196	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	32
PID 2876 wrote to memory of 2196	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	32
PID 2876 wrote to memory of 2992	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	33
PID 2876 wrote to memory of 2992	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	33
PID 2876 wrote to memory of 2992	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	33
PID 2876 wrote to memory of 2992	2876	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	33
PID 2992 wrote to memory of 2628	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	34
PID 2992 wrote to memory of 2628	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	34
PID 2992 wrote to memory of 2628	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	34
PID 2992 wrote to memory of 2628	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	34
PID 2992 wrote to memory of 2184	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	35
PID 2992 wrote to memory of 2184	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	35
PID 2992 wrote to memory of 2184	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	35
PID 2992 wrote to memory of 2184	2992	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	35
PID 2184 wrote to memory of 2616	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	36
PID 2184 wrote to memory of 2616	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	36
PID 2184 wrote to memory of 2616	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	36
PID 2184 wrote to memory of 2616	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	36
PID 2184 wrote to memory of 2624	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	37
PID 2184 wrote to memory of 2624	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	37
PID 2184 wrote to memory of 2624	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	37
PID 2184 wrote to memory of 2624	2184	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	37
PID 2624 wrote to memory of 2460	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	38
PID 2624 wrote to memory of 2460	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	38
PID 2624 wrote to memory of 2460	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	38
PID 2624 wrote to memory of 2460	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	38
PID 2624 wrote to memory of 2172	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	39
PID 2624 wrote to memory of 2172	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	39
PID 2624 wrote to memory of 2172	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	39
PID 2624 wrote to memory of 2172	2624	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	39
PID 2172 wrote to memory of 2428	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	40
PID 2172 wrote to memory of 2428	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	40
PID 2172 wrote to memory of 2428	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	40
PID 2172 wrote to memory of 2428	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	40
PID 2172 wrote to memory of 2040	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	41
PID 2172 wrote to memory of 2040	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	41
PID 2172 wrote to memory of 2040	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	41
PID 2172 wrote to memory of 2040	2172	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	41
PID 2040 wrote to memory of 1812	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	42
PID 2040 wrote to memory of 1812	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	42
PID 2040 wrote to memory of 1812	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	42
PID 2040 wrote to memory of 1812	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	42
PID 2040 wrote to memory of 2784	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	43
PID 2040 wrote to memory of 2784	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	43
PID 2040 wrote to memory of 2784	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	43
PID 2040 wrote to memory of 2784	2040	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	43
PID 2784 wrote to memory of 2152	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	45
PID 2784 wrote to memory of 2152	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	45
PID 2784 wrote to memory of 2152	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	45
PID 2784 wrote to memory of 2152	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	45
PID 2784 wrote to memory of 2420	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	46
PID 2784 wrote to memory of 2420	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	46
PID 2784 wrote to memory of 2420	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	46
PID 2784 wrote to memory of 2420	2784	00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe	46

C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
"C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
  "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
  2⤵
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
  "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
    "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
    3⤵
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
    "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
      "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
      "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        5⤵
        
        PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        6⤵
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        8⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        8⤵
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        9⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        10⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        11⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        12⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        12⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        13⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        13⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        14⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        14⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        15⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        15⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        16⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        16⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        17⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        18⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        18⤵
        Suspicious behavior: MapViewOfSection
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        19⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        19⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        20⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        20⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        21⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        21⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        22⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        23⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        23⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        24⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        24⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        25⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        25⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        26⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        26⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        27⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        27⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        28⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        28⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        29⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        29⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        30⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        30⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        31⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        31⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        32⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        32⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        33⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        33⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        34⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        34⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        35⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        35⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        36⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        36⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        37⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        37⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        38⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        38⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        39⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        39⤵
        Suspicious behavior: MapViewOfSection
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        40⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        40⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        41⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        41⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        42⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        42⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        43⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        43⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        44⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        44⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        45⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        45⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        46⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        46⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        47⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        47⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        48⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        48⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        49⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        49⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        50⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        50⤵
        Suspicious behavior: MapViewOfSection
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        51⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        51⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        52⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        52⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        53⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        53⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        54⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        54⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        55⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        55⤵
        Suspicious behavior: MapViewOfSection
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        56⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        56⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        57⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        57⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        58⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        58⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        59⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        59⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        60⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        60⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        61⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        61⤵
        Suspicious behavior: MapViewOfSection
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        62⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        62⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        63⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        63⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        64⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        64⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        65⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        65⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        66⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        67⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        68⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        68⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        69⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        70⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        71⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        72⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        72⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        73⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        73⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        74⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        75⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        75⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        76⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        77⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        77⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        78⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        78⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        79⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        79⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        80⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        80⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        81⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        81⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        82⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        83⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        83⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        84⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        84⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        85⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        85⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        86⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        86⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        87⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        88⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        89⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        89⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        90⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        91⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        92⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        93⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        94⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        95⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        96⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        96⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        97⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        97⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        98⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        98⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        99⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        99⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        100⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        101⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        102⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        102⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        103⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        103⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        104⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        104⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        105⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        106⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        107⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        108⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        108⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        109⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        110⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        111⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        112⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        113⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe
        
        "C:\Users\Admin\AppData\Local\Temp\00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974.exe"
        113⤵
        
        PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut9389.tmp

Filesize
81KB

MD5
ab086c86688383bcf8530ac7282b06fe

SHA1
287324402fc6f031aefbd86aae6cc8a8e6390612

SHA256
1ab928f8c861c3fa1d77b217cc1d870782506d737161a5da80a08bb5097bbbd4

SHA512
97d227d258b523dbe56ca073022cb44f619d7e2bc746c73f52f38dccb2b05c759dde654cfe657312ff27f6446953ef3a9db40584d17355f9895ea5854b27771e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut938A.tmp

Filesize
9KB

MD5
06f9b030f1c9471862936fffb7ff2bff

SHA1
2cc9d719383c292dc20314030956ace43aed4fa6

SHA256
e1a64c5d73f5e161206e18cea150e70b38774061811412d5b21a1d959c42fa1a

SHA512
1c02f594516d9aa76b0e7945ffd55d1df63f8932adb036bf647186a4622d5aec40202143f09e4f9bfdebd9740ded57a5a70e60a05269b489877eb769b34ebefe

Download Submit
C:\Users\Admin\AppData\Local\Temp\bohmite

Filesize
28KB

MD5
39f879021a31d34ff5a403d9171c067e

SHA1
6b8b65b9e95fa187dd8f09827ae5742bd5a19c2f

SHA256
392cc2eb51375ddb85e7563f3c264f130e52cd11fda47e1bd9e3612d753a5b02

SHA512
3951b5dcd3e791e84f89e95211aa3c11230cfdfd7d7369ad87894f217bf9e113ab2ccb5e049ae727b6b64d068101f3233041eee2160326ded431451112cab64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bohmite

Filesize
28KB

MD5
aef31ad37942a1c1b80b9646b86adac8

SHA1
8d7e6f86fbd956963fbc5aceaff8bba67eb9c9b7

SHA256
b9ef9f605f9680fc5644f7a640cad1685a2b191e8ea976b663b4ab0b16ef3ebd

SHA512
c433bb7f2a78fc4fcff292ee3d7cbad70cd33dbc94ea0314e26104d9f23e0268d8cafa36dbc348b01b2fcd4f8b6dc7accf4e7ff928038f966b715afce1d1c16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lophophorine

Filesize
104KB

MD5
92c70e15ed46fbf3caf971cdc8307b76

SHA1
f2b6c327e0f522ad4d1382d340fe9235aa7aa035

SHA256
ce5d6a0eee4252bfe33358b458878c52bd3487543daf87e5548c056f3e747878

SHA512
b9f679d0ec0c3c510c0d5a67b85724ac0561c718668a4cd242c91b452f4bc3821d70ee7fefcc37eb7e1c03feb412a3005359d6f0b747c86d5935979714267374

Download Submit
memory/2388-965-0x00000000772B0000-0x00000000773CF000-memory.dmp

Filesize
1.1MB

Download
memory/2388-966-0x00000000773D0000-0x00000000774CA000-memory.dmp

Filesize
1000KB

Download
memory/2468-10-0x0000000000190000-0x0000000000194000-memory.dmp

Filesize
16KB

Download